Shadow IT surge threatens corporate data: report

Dive Brief:

The volume of corporate data placed into artificial intelligence tools by workers skyrocketed 485% from March 2023 to March 2024, exposing businesses to heightened risks, according to a report released Tuesday by cybersecurity company Cyberhaven.
Workers are putting company data into personal “shadow AI” accounts that, unlike enterprise versions, potentially expose whatever is shared with them to the public, according to the research.
"AI usage at work is increasing at an exponential rate and so is the amount of corporate data pasted or uploaded to AI tools,” the report said.

Dive Insight:

Ninety-three percent of cybersecurity leaders say their companies have deployed generative AI, yet 34% of those using the technology have not taken steps to minimize security risks, cybersecurity firm Splunk found in a recent survey, as previously reported by CFO Dive.

“Of course, thoughtful security policies don’t necessarily translate to complete prevention, but they can go a long way to minimize data leakage and other new vulnerabilities,” Splunk said in a report on the findings.

AI adoption has increased so quickly that knowledge workers, on average, now put more corporate data into AI tools on a Saturday or Sunday than they did during the middle of the work week a year ago, Cyberhaven found.

“Similar to the early days of cloud adoption, workers are using AI tools ahead of IT departments formally buying them,” the report said. “The result is ‘shadow AI,’ employee usage of AI tools through personal accounts that are not sanctioned by — or even known to — the company.”

The leading form of sensitive data fed into AI tools was customer support information, including confidential customer details (16.3%). Other categories included source code (12.7%), research and development materials (10.8%), HR and employees records (3.9%), and financial documents (2.3%).

ChatGPT, created by Microsoft-backed startup OpenAI, remains the most frequently used AI application in the workplace, according to the research.

OpenAI launched an enterprise version of ChatGPT in August 2023 with enhanced security safeguards. But Cyberhaven said it found that a “significant majority” of corporate ChatGPT accounts are still personal ones.

The analysis was based on a dataset derived from the AI usage patterns of 3 million workers, Cyberhaven said.