A marketing coordinator pastes a draft press release into a chatbot to tidy up the wording. A developer drops a stack trace, internal hostnames and all, into an AI coding assistant. Someone in finance uploads a spreadsheet of vendor payments to get a quick summary before a meeting. Not one of them thinks they’re doing anything wrong. They’re just trying to get through the day faster, which is exactly what their managers keep asking for.
That’s how generative AI actually got into most workplaces. Not through procurement. Not through a security review. Through browser tabs, personal Gmail logins and free tiers. By the time IT got round to asking which AI tools people were using, the honest answer was “basically all of them, and no idea where the data ended up.”
Now lots of companies are scrambling to catch up, drafting usage rules and shopping for AI security solutions to get some visibility back. Before you pick either, though, it’s worth understanding what really changed.
The data found a new way out
Think about Amara. She’s made up, but every IT lead will recognise her. She runs security at a 200-person logistics company, and for years she knew roughly where the company’s sensitive stuff lived: the file server, a handful of SaaS apps, the finance database. She knew where the doors were and kept an eye on them.
Then every browser tab with a chat box became a new door. And what walks out through it isn’t a neat file she can flag. It’s a paragraph lifted from a contract, twenty lines of source code, a customer complaint with a name and mobile number still attached.
Her data loss prevention tools were built for a different era. They’re good at spotting a credit card number in an email or a huge upload to a strange server. They’re hopeless at deciding whether 400 words typed into a chatbot include a trade secret. That blind spot is where most of the exposure sits today.
Then there’s the other end of the conversation. Some AI providers keep what you type to improve their models unless you switch that off. Others hold on to chat history indefinitely by default. When an employee uses a personal account, they’ve signed up to terms nobody at the company ever read, and if something goes wrong, the company has no contract to point to. It’s the same story behind the steady trickle of cases where staff paste company secrets into consumer chatbots without blinking.
Why you can’t just build a taller fence
The old way of thinking was simple: guard the edge of the network, keep the bad guys outside, trust whoever’s inside. Remote work had already cracked that idea. AI tools finished the job.
Traffic to a chatbot looks just like normal encrypted browsing. Blocking the big names barely helps, because a new tool pops up every week, and plenty of them come baked into software you already pay for: the office suite, the CRM, the design app.
Banning everything doesn’t work either. Samsung famously barred staff from using generative AI tools in May 2023, after employees pasted sensitive code into ChatGPT. Most companies watching took away a different lesson than “ban it all.” If you block AI and don’t offer anything approved in its place, people don’t stop. They just switch to their phones and home laptops, where you can see even less.
A whole new set of headaches
Leaks grab the headlines, but they’re not the only worry. Once a company starts building its own AI, like an internal assistant hooked up to the shared drive or a chatbot answering customers, a different kind of risk moves in.
The big one is prompt injection, which sits at number one on OWASP’s Top 10 for large language model applications. The trick is sneaky. An attacker hides instructions inside something the AI will read, like a web page, an email, or a PDF, and the AI simply does what it’s told. If Amara’s internal assistant can open files or send messages, one cleverly written document could turn it against the very people using it. There’s no complete fix yet, just layers of defence.
There’s more. Models can spill bits of their training data or retrieved documents. Datasets can be poisoned to skew answers. And then there’s the quiet one: AI agents with far more access than the person using them should ever have. Half of these are AI problems. The other half are boring old access-control problems wearing a new hat.
Where the network side earns its keep
This is usually where talk moves from policy documents to actual plumbing. Amara can’t write a sensible rule until she knows which AI services people connect to, from which devices and with what access. Without that, any policy is a guess.
The tools teams are turning to mix some familiar ideas in a new setting. Zero trust access checks every connection instead of assuming it’s fine. DNS and web filtering can tell approved AI tools apart from random new ones. Device checks keep unmanaged laptops away from anything sensitive. Segmentation stops an internal AI agent wandering wherever it likes. Some platforms now add a browser layer as well, showing which AI tools and extensions people really use and limiting what can be pasted into them. It’s not exciting stuff, but it fits the reality: AI use is a traffic and identity problem just as much as a model problem.
None of this is about reading over everyone’s shoulder. It’s about making sure only verified people on trusted devices can reach sensitive systems, and that AI traffic goes through routes the company can actually see.
Rules people won’t ignore
Controls work much better when they come with rules people understand. The AI policies that stick tend to be specific. They name the tools that are approved instead of waving at “responsible use.” They give real examples of what not to paste: customer records, unreleased financials, passwords, proprietary code. And they say why in a couple of plain sentences, not three pages of legal language.
They also make asking for a new tool easy. If approval takes six weeks, nobody’s waiting. Amara’s team turns requests around in a few days. They check how the vendor stores data and what access it needs, then give a yes or no. That keeps people using tools she can see instead of ones she can’t.
Is any of it working?
The teams that handle this well never treat it as finished. Amara checks how many different AI services show up in her network logs each month, and whether that number is shrinking towards the approved list. She looks at which departments use AI the most and goes and talks to them about what they actually need. Once a quarter, her team runs a drill where a prompt injection takes over an internal assistant, just to see how fast they’d notice and shut it down.
She also re-reads vendor terms, more often than feels necessary. AI companies change their data rules far more often than most software firms. A tool that was fine to approve last spring might have new retention settings today, and the only way to find out is to keep looking.
So where does that leave you?
Shadow AI isn’t something coming down the road. It’s already in the building, probably open in a tab right now. The companies getting this right aren’t trying to ban their way out of it. They’re handing people approved tools that genuinely help, putting visibility and access controls around the traffic, and checking regularly as the tools and terms keep shifting. Do that, and AI stops being a blind spot and becomes just one more part of the network you look after.
