You're being filmed: the insider you never hired (and can't fire)

In many organizations, AI’s arrival was quiet. There was no approval committee, no contract was drafted, no permissions were configured. It just showed up: embedded in a workflow, connected to internal data, making decisions without anyone in security knowing about it.

We call this Shadow AI: the use of artificial intelligence inside a company without authorization, oversight, or control. A new kind of “employee” that doesn’t show up on the org chart, has no personnel file or formal credentials, but accesses critical information and can influence strategic operations.

An insider with no contract

Shadow AI works like a non-human insider. Once it’s onboarded, it can stay active even after the person who deployed it leaves. Its persistence doesn’t depend on an employment contract, but on whether its code keeps running somewhere in the infrastructure. And that makes it a standing risk.

A phenomenon driven by hyper-adoption

The rise of generative AI and autonomous agents has led to more than 70% of companies using some form of AI to automate tasks in under two years. In many cases, these deployments originate from business units looking to save time, improve customer service, or process large volumes of data. The problem is that, without IT and Security involvement, these initiatives can:

• Process sensitive information in external environments.
• Introduce technology dependencies without risk assessment.
• Escape any formal audit or control.

A real case

In 2024, a financial services company discovered that a marketing team was using an AI assistant to draft reports and answer internal queries. The model, hosted in a third party’s cloud, had processed customer data unencrypted and out of compliance with internal data protection policies. The alert came up by chance, during a network audit. By then, the AI had been operating unsupervised for more than six months.

Why it’s a real risk

• Lack of traceability: there’s no way to know what data it processes or how it stores it.
• Expanded attack surface: every uncontrolled AI agent is a new potential vector.
• Compromised regulatory compliance: makes it harder to comply with data protection and security regulations.
• Resistance to detection: by embedding itself in legitimate processes, it can go unnoticed by monitoring systems.

Governance and best practices

The answer to Shadow AI isn’t banning AI, it’s governing it:

1. Inventory every use of AI in the organization, authorized or not.
2. Define clear policies that set technical and legal criteria for deployment.
3. Implement technical controls that detect and alert on unauthorized use.
4. Train teams to understand the risks and act as the first line of defense.

Conclusion

Artificial intelligence is an enormously valuable tool when it’s deployed in a controlled way, aligned with strategy, and backed by a solid governance framework. But when it operates in the shadows, it turns into an unpredictable actor that’s hard to neutralize.

In this new landscape, the challenge isn’t just adopting AI, it’s making sure every intelligence working for the organization is under contract, with clear rules and defined responsibilities.

Originally published on LinkedIn.