Swan’s Client Fighting Shadow AI

As AI proliferates, many new terms are being coined. One such phrase is Shadow AI.

What exactly is Shadow AI?

Shadow AI is the use of AI in a business without the knowledge, approval, or oversight of those in leadership or the IT department. It can happen when —

• a lawyer feeds privileged information into a chatbot to have it generate precedents.
• an intern feeds a patient’s private medical history into an AI tool to receive a second opinion or a suggested diagnosis.
• an executive puts a confidential document into an AI tool to check for errors or mistakes.

This is by no means a comprehensive list of who might use AI to help in his or her work without thinking about the implications. From financial advisors to software engineers, there is an allure to being able to use a tool that can seemingly improve one’s work and save time.

So what’s the problem?

People have an expectation of privacy that AI tools cannot guarantee.

This is an understandable expectation.

On social media, one knows if he or she is posting on a public forum, it’s public. If one enters a private chat with someone, it’s assumed that whatever is said will be between the two of them. A person chatting with an AI chatbot or using an AI tool feels like they are in a private chat. After all, he or she is the only one there with the AI, and the AI sounds like a person on the other end.

In fact, one might even tell things to an AI one wouldn’t tell to a friend since, after all, it’s not a real human and can never tell.

Only whatever one shares with a chatbot isn’t private. This is embarrassing if one shared a photo of the odd-shaped mole on their arm. The consequences can be far more than red cheeks if one has shared confidential information, documents, or code. Some risks include —

• Data retention in logs
• Human review of conversations
• Third-party sub-processors
• Prompt injection and data exfiltration
• Model output leakage (regurgitation risk)
• Misconfigured integrations
• Data reuse inside the organization (secondary exposure)
• Insider access and policy abuse

What does Shadow AI mean for a business?

One of the biggest problems is that many businesses are completely unaware of how much privileged information might be leaked to an AI tool.

Employees using AI are not trying to be malicious. For them, using an AI tool can save them (and the company) time. He or she can use that time for other tasks. Why spend hours going over a document when AI can summarize it in seconds?

The reality is that once that confidential document or proprietary source code is put through the chatbot, it is no longer private.

Worse, many companies have leaders and IT departments who are completely clueless about just how widespread the AI tool use is, what AI tools are being used, and how much information is at risk of being compromised by well-meaning but uninformed employees.

Still worse, this doesn’t just compromise information. It might risk a company being exposed to real legal trouble. Compliance frameworks such as HIPPA and GDPR can levy heavy fines on companies for violations involving unauthorized AI use.

What is being done to combat the problem?

Some companies have adopted a zero-AI rule, but the reality is, it won’t stop people from using AI. It will merely make them hide it better. The problem of a lack of oversight over AI usage will only worsen.

Rick Barretto, Founder and CEO of CyberHopeAI, recognized the problem, and he realized that there needed to be a way for companies to use AI the right way. He created CyberHopeAI to make it possible for companies to use AI that would keep privileged information private and allow both leaders and IT to know where, when, how, and what AI is being used.

To read the full article with more details about CyberHopeAI, click here.

Swan Software Solutions has worked with Rick Barretto for many years. When he began to work on this exciting new project, he reached out to Swan. Swan was thrilled to become his technology partner again.

We’re excited to work on this project that is solving a very serious problem faced by many organizations. And if you have an idea and need the right technology partner, contact us to find out how we can help.