By: Dave Santeramo
Do you know how your employees are using AI today? If you’re not 100% sure, you’re not alone.Whether you lead IT for a rural school district or a global enterprise, AI is now embedded in so many everyday tools that many of your employees may not even realize they’re using it. Your security teams may not have an accurate picture either. Like shadow IT before it, shadow AI puts your organization at risk. Unlike shadow IT, it is far harder to detect, which makes shadow AI visibility one of the most important priorities for security leaders today.
Why shadow AI isn’t shadow IT
Shadow IT has largely been an infrastructure problem. Your employees may have brought in personal hard drives for backups or connected their own wireless devices to the corporate network. And if your organization has research labs, you’ve likely seen plenty of it there as engineers tinkered with easy-to-buy cloud resources or inexpensive hardware. Because these were physical or infrastructure assets, they usually left evidence. Each shadow IT asset, while perhaps unapproved, performed a predictable function.
Shadow AI is different because it’s intangible. It involves unsanctioned AI tools rather than unapproved hardware, and new tools appear almost daily. More importantly, the core risk is your data leaving your organization, not a misconfiguration. When an employee uploads a spreadsheet to an AI tool to finish a task faster, sensitive information may leave your environment without anyone realizing it. That data may be stored and reused in a model outside of your control. As one speaker at a recent industry conference put it, shadow IT introduced unmanaged technology, while shadow AI introduces unmanaged intelligence.
If this pattern feels familiar, it should. More than a decade ago, cloud adoption raised many of the same challenges, and security teams were playing catch-up then, too. Your employees are generally not acting in bad faith. They’re trying to get their work done, and many would rather ask forgiveness than permission.
How AI enters your organization
What makes today’s challenge unique is that AI no longer depends on someone choosing to install something new. It often arrives through the software your employees already use. Even Microsoft Paint, an application dating to the early 1990s, now includes Copilot. Beyond these embedded features, employees can enable agents with a few clicks inside platforms such as Salesforce, Workday, and Microsoft 365. Some of those agents connect directly to your data sources through APIs.
At the same time, your business teams are likely adopting AI quickly to stay competitive. As a result, your IT and security teams are working to keep pace with a landscape that changes faster than your traditional security review processes allow.
Why blocking AI falls short
Two years ago, many CIOs and CISOs responded to AI by prohibiting it outright. That approach has largely disappeared. As with early cloud adoption, initial blanket bans didn’t stop usage. They simply pushed AI use out of IT view and into personal accounts. Recognizing that outright bans don’t work, many organization have shifted to a block/allow approach.
However, selective blocking is brings its own challenges. You might permit one AI tool while banning others, but with hundreds of tools available, no network-level policy can realistically account for all of them. Chasing individual tools or combing through log data becomes a game of whack-a-mole. While reacting to AI use after it has happened with a block/allow approach may prevent further use of a particular AI tool, the damage may have already been done and the data may have already left your control. To truly reduce risk, you need to see AI usage as it happens.
What AI visibility requires
Because shadow AI doesn’t involve a physical device, your visibility must extend into the data and traffic itself. This is why AI gateways are gaining traction. Many organizations deploy them initially not to block activity but simply to understand what’s happening. They’re often surprised by what they find, and you may be too.
Encryption adds another layer of difficulty. Most AI traffic travels over HTTPS or TLS, the encrypted protocols that protect web communications. If your organization doesn’t inspect that encrypted traffic, you can see that employees are using AI, but not they’re sharing. Effective shadow AI visibility requires inspecting the AI traffic moving through your environment.
Where to begin
If you have little or no visibility into AI use today, start by gaining visibility before you try to control anything. You can’t defend what you can’t see. Some organizations try to repurpose their existing network tools, but relying on network log analysis is like trying to catch fish with your bare hands. You’ll catch some AI use, but you will miss more than you catch. What you need is a net, specifically an AI net.
F5 Workforce AI Security provides that foundation by giving your IT team visibility into the AI tools, prompts, and sensitive data in use across your workforce. From there, an AI gateway, much like the cloud access security brokers (CASBs) you may have adopted a decade ago, lets you route AI traffic through a central point and build policy around what can and cannot be used.
How Pellera and F5 work together
Pellera partners with leaders like you to build a tailored AI visibility and security plan and to deploy F5 Workforce AI Security and F5 AI Gateway. Pellera solution architects work with customers across industries, including healthcare and higher education, so they can show you how other organizations have addressed the risk of shadow AI. The Pellera service team, which includes F5 trained engineers, then turns your plan into a working deployment.
Preparing for agentic AI
Getting visibility and safeguarding generative AI use is only the beginning. As agentic AI matures, your employees will increasingly build their own agents to accelerate their work, effectively becoming developers. The next two to three years will test how well your organization has prepared. By establishing shadow AI visibility now, you’ll be better positioned to govern AI and AI data use as it evolves while continuing to support the innovation your business depends on. Together, Pellera and F5 can help you get the visibility into your AI use as a first step before evolving to AI data governance with the same winning partnership. Contact us today to schedule a consultation.
