AI Is Creating a New Kind of Shadow IT

Last week we wrote about how the next inside threat might be an AI agent. Today we are going to talk about a recent kind of issue we have noticed with clients: shadow IT with agents.

For years, IT departments have dealt with shadow IT, where employees adopt software, cloud services, or other technologies without the knowledge or approval of their IT teams. While these tools may help employees work more efficiently, they can also introduce security risks, duplicate costs, and create problems with data management.

Artificial intelligence is making this problem more complicated.

Employees are increasingly using AI assistants, browser extensions, and autonomous agents to help with everyday tasks. Some simply summarize documents or generate content, while others can interact with websites, access company systems, modify files, and execute actions on behalf of users.

And these tools are often adopted without the same security reviews, access controls, or oversight that businesses would normally apply to new software.

When AI Moves Beyond Providing Answers

The distinction between traditional AI assistants and AI agents is important. An AI assistant that generates a response has relatively limited capabilities (even though it may still have access to confidential information), but an agent that can take actions introduces additional risks.

For example, last week we used the example where an employee installed an AI browser extension to help manage content on a company website and ended up crashing it.

An incorrectly configured tool, an unexpected instruction, or a poorly designed automated workflow could create problems that extend well beyond the original task.

There are also concerns about sensitive information being shared with third-party AI services, particularly when employees use personal accounts or tools that have not been reviewed by IT.

Visibility Is Becoming a Bigger Challenge

Microsoft has introduced capabilities to help organizations discover and manage unauthorized AI tools and agents. Its Shadow AI management features reflect a growing recognition that businesses need to know not only which applications employees are using, but also what those applications can access and do.

However, simply blocking AI tools is unlikely to be an effective long-term strategy. Employees are adopting these technologies because they offer genuine productivity benefits, and overly restrictive policies may encourage more “creative” and unauthorized usage.

Businesses need a practical approach that allows employees to experiment while maintaining appropriate controls over company information and systems.

This includes:

1. Understanding (and documenting) which AI tools are being used
2. Reviewing their permissions
3. Restricting unnecessary access
4. Establishing clear guidelines for when human approval is required
5. Training for the above

AI Adoption Needs to Be Part of IT Management

In short, as AI becomes embedded in everyday business operations, managing it can no longer be treated as a separate experiment. Organizations need to approach AI adoption with the same attention they give to cybersecurity, software management, access controls, and business continuity.

Smartt helps businesses evaluate, secure, and integrate emerging technologies into their existing IT environments. Contact us to discuss how your organization can adopt AI while maintaining appropriate security and operational controls.