Latest / Modularity Podcast / Shadow AI: The Hidden Data Leak in Your Business

Transcript

Shadow AI: The Hidden Data Leak in Your Business · Modularity Podcast

• 0:00
  Picture last Tuesday, quarter to five.
• 0:02
  Someone on your team is staring at a spreadsheet of three hundred customers that is
• 0:06
  a complete mess.
• 0:08
  So they open a free ChatGPT account, on their personal login,
• 0:12
  paste in all three hundred rows, and forty seconds later it's clean.
• 0:17
  They go home on time.
• 0:18
  You never know it happened.
• 0:20
  And here's the thing, they weren't being sneaky.
• 0:23
  They were being efficient.
• 0:25
  That's what makes this tricky.
• 0:26
  A lot of owners tell themselves, we don't use AI, we never bought anything.
• 0:31
  But UpGuard's 2025 research found that 81 percent of employees use unapproved AI
• 0:37
  tools on the job.
• 0:39
  Menlo Security found 68 percent use free tier tools through personal accounts,
• 0:44
  and 57 percent admitted to putting sensitive data into them.
• 0:48
  So the question isn't whether your business uses AI.
• 0:51
  It's whether you know where.
• 0:53
  There's a name for it.
• 0:54
  Shadow AI.
• 0:55
  It just means employees using AI tools for company work that nobody approved or set
• 0:59
  up.
• 1:00
  Personal ChatGPT, Claude, or Gemini logins.
• 1:04
  Browser add-ons.
• 1:05
  Meeting recorder bots that join your calls.
• 1:08
  All of it is happening outside your view.
• 1:10
  And I want to explain why this isn't the same as someone using an unapproved file
• 1:15
  sharing account.
• 1:16
  If a person saves a file to the wrong folder, that's a problem,
• 1:20
  but it's a contained one.
• 1:21
  You can shut off the login, delete the files, and it's done.
• 1:25
  With a consumer AI tool, the text gets sent to the provider's servers,
• 1:30
  it sits in prompt logs, and in many cases it can be kept and used to train future
• 1:35
  versions of the model.
• 1:36
  Depending on the settings, you can't pull it back.
• 1:39
  You can't audit it.
• 1:40
  It's like sending a postcard and then realizing you can't ask the mail carrier to
• 1:44
  return it.
• 1:45
  Samsung is the example everyone cites.
• 1:47
  Engineers pasted proprietary chip data into a consumer chatbot to fix errors.
• 1:53
  Nobody was trying to leak anything.
• 1:55
  They were trying to debug faster.
• 1:57
  And the browser add-ons are the quieter version of this.
• 2:00
  A grammar checker or a summarizer that asks for permission to read every page you
• 2:05
  visit can see your customer records, your email threads, your accounting dashboard,
• 2:10
  whatever happens to be open in the next tab.
• 2:12
  That's the part I'd push owners on.
• 2:14
  Everybody thinks about the chat window.
• 2:16
  Nobody thinks about the little extension they installed eight months ago because it
• 2:19
  promised to make emails sound nicer.
• 2:21
  So why does this hit the bottom line?
• 2:23
  Start with money.
• 2:25
  IBM's 2025 breach cost report found that organizations with a high level of shadow
• 2:31
  AI paid about 670,000 dollars more when they had a breach.
• 2:38
  And the research summaries pass along a detection time of around 247 days,
• 2:44
  which, if accurate, means information could be flowing out for the better part of a
• 2:49
  year before anyone notices.
• 2:51
  Then there's the legal side.
• 2:52
  If you run a medical or wellness practice, healthcare privacy law,
• 2:56
  the one people call HIPAA, expects a signed agreement with any vendor that touches
• 3:01
  patient information.
• 3:02
  A free chatbot account doesn't come with one.
• 3:05
  If you're a law firm or an accountant, pasting a client's documents in probably
• 3:09
  breaks your confidentiality promises.
• 3:11
  And for anybody with proprietary pricing or bidding formulas,
• 3:15
  trade secret protection depends on making reasonable efforts to keep them secret.
• 3:19
  Pasting them into a public tool arguably undercuts that.
• 3:22
  Two more.
• 3:23
  Cyber insurance carriers are reportedly adding AI questions to renewal forms,
• 3:28
  and if you've got no written policy, that's an awkward conversation to have after an
• 3:33
  incident.
• 3:33
  And then there's plain old quality.
• 3:36
  AI can sound completely confident while being wrong.
• 3:40
  If somebody drops a made up number into a customer quote, that's on you.
• 3:45
  So what do you actually do?
• 3:46
  First, don't ban it.
• 3:49
  It's tempting, but bans don't stop the usage, they stop your visibility.
• 3:53
  People just move to their phones and personal laptops, and now you can't see
• 3:57
  anything at all.
• 3:57
  Right.
• 3:58
  Second, give people a simple traffic light for data.
• 4:01
  Green is safe: brainstorming, public marketing copy, an email outline with no client
• 4:07
  names in it.
• 4:08
  Amber means company accounts only, like internal project plans or data with the
• 4:13
  identifying details removed.
• 4:15
  Red means client records, financial spreadsheets, patient details,
• 4:20
  anything under a nondisclosure agreement.
• 4:22
  Those need dummy numbers or your written okay.
• 4:25
  And then there's a fourth category that's just off limits, period: passwords,
• 4:30
  security codes, bank account numbers, card numbers.
• 4:33
  Third, give everybody a real option.
• 4:36
  Set up named company accounts, one per person, not a shared login.
• 4:41
  And turn off the setting that lets the provider train on your data,
• 4:45
  wherever that setting exists.
• 4:47
  If the sanctioned tool is easy, nobody goes hunting for the sketchy one.
• 4:51
  Fourth, a human signs off.
• 4:53
  AI drafts, a named person checks every number, every factual claim,
• 4:58
  and anything going to a customer before it goes out.
• 5:01
  That one rule catches the embarrassing mistakes.
• 5:05
  Now, quick wins for this week.
• 5:07
  One, run an amnesty.
• 5:09
  Fifteen minutes, three questions, zero blame.
• 5:12
  What AI tools are you using, which accounts are you logged into,
• 5:16
  and what browser extensions have you installed?
• 5:18
  Say out loud that nobody is in trouble.
• 5:21
  You'll get honest answers precisely because you said that.
• 5:24
  Two, a five minute audit.
• 5:26
  Look through browser extensions for anything that can read the content of every
• 5:30
  page, and remove what you don't need.
• 5:32
  Then check the settings on the tools people are actually using and switch off data
• 5:37
  sharing for training.
• 5:38
  Three, one page.
• 5:39
  Put the green, amber, and red rules on a single sheet, hand it out,
• 5:43
  and have people sign it.
• 5:45
  It also gives you something to show when an insurance form asks whether you have an
• 5:49
  AI policy.
• 5:50
  The takeaway is this.
• 5:52
  The technology isn't the threat.
• 5:55
  Ungoverned technology is.
• 5:58
  Your team is already using AI because it makes their day easier,
• 6:02
  so don't fight that.
• 6:03
  Give them guardrails, so they can move fast without betting your customers'
• 6:07
  information on it.
• 6:09
  And if you want help setting up practical, secure tools like this in your business,
• 6:13
  you can learn more at modularity.us.