Shadow IT remains a persistent issue for CISOs, but the unregulated use of AI by senior executives might be the leading concern. A recent survey by TrustedTech reveals that nearly two-thirds of senior leaders admit to using unapproved AI tools, contrasting sharply with just 31% of lower-level employees. This disparity highlights a troubling culture of risk acceptance among top executives.
Despite awareness of security and privacy threats—three out of four employees recognize these risks—executives continue to use shadow AI. As the TrustedTech white paper suggests, this behavior isn't simply a matter of ignorance; it's rooted in organizational culture and the availability of suitable alternatives.
The Executive Dilemma
The prevalence of shadow AI among C-suite members poses unique problems for IT leaders, who often lack the authority to impose restrictions on these behaviors. When executives opt for unapproved AI tools, it disrupts governance from the top down. Andy Nolan, VP of technology at TrustedTech, emphasizes that such actions send a message prioritizing speed over security, undermining compliance efforts across the organization. Employees take notice of this contradictory behavior, making adherence to protocols increasingly difficult.
Moreover, the issues compound because executives typically deal with highly sensitive information, such as financial data and customer records. Yet, CISOs can't merely clamp down on shadow AI usage; their role is to facilitate safe innovation. Effective strategies require alignment with executive leadership, clear governance, and providing appealing, secure AI solutions that everyone can utilize.
The Accountability Gap
The lack of visibility into shadow AI usage exacerbates challenges for CISOs and CIOs, according to Amit Maloo, CISO at Ivalua. These leaders are often held responsible for potential security breaches, yet they are left in the dark about ungoverned AI tools being employed by senior management. When high-level decisions are based on these risk-laden tools, the consequences can carry financial and operational weight without any clear oversight.
"With no permissions model or audit trail, it’s impossible to know who made what decision and why," Maloo notes. Organizations need to pair effective AI governance with usability, he argues. If sanctioned AI solutions can't accommodate the pace of business, users will inevitably seek alternatives, including those that aren’t governed by policy. The most successful companies will be those that facilitate the easiest, secure pathway to innovation.
The Speed vs. Security Paradox
Evidence from TrustedTech closely mirrors findings from a June report by Teramind, which reveals that the majority of C-level executives favor speed over security in their AI tool usage. Nik Kale, a principal engineer at Cisco, points out that two-thirds of enterprise AI engagement occurs through personal accounts—often using the same tools sanctioned by their organizations but bypassing official channels for expedience.
The real issue isn’t necessarily the available tools; rather, it’s the friction involved in using sanctioned options. Kale articulates that individuals often find themselves circumventing the traditional processes not because the tools are inadequate, but because the sanctioned options are cumbersome and slow.
Additionally, Matthew Scavetta, chief technology innovation officer at Future Tech Enterprise, indicates that organizations often fail to effectively promote the AI tools at employees’ disposal. Without proper awareness and training on these applications, users frequently default to familiar, yet ungoverned alternatives. “If you don’t solve problems quickly or make people aware of which tools they can use safely, they will find a workaround,” he warns.
As this tension continues, CIOs are increasingly challenged to balance achieving innovative outcomes with practical risks. The pressure to keep pace with emerging technologies is ever-present, and executives may become enamored with AI hype without understanding the actual return on investment. This ongoing struggle complicates the IT landscape, making it crucial for organizations to streamline access to safe alternatives that meet the demands of today’s fast-paced business environment.
