On May 21, UzCloud Product Director Dmitry Nekrasov spoke at the "Code IB" conference. His presentation was dedicated to a highly relevant topic for business: the use of third-party neural networks without the knowledge of IT departments and security services. This phenomenon is commonly referred to as Shadow AI.
Below are the key takeaways from the presentation, a breakdown of the risks, and practical steps for building a secure IT architecture to work with artificial intelligence.
Shadow AI: A Symptom of a Product Vacuum, Not a Violation
When a lawyer copies the text of a contract into a personal account of a popular neural network for a quick edit, or a developer sends a code snippet to an external AI assistant, they are driven by a desire to optimize workflows.
Statistics reveal the real motives of employees:
- 90% of users note that artificial intelligence significantly saves their working time.
- 68% of employees simply cannot keep up with the current pace of work without leveraging automation.
- 85% of specialists use AI to relieve themselves of routine tasks and focus on what truly matters.
Shadow AI is defined as the use of external artificial intelligence tools outside the company-approved perimeter, without data masking or logging. According to research, 57% of employees hide their use of such services in the workplace, and 48% have already uploaded confidential company information to public platforms.
Thus, Shadow AI becomes an obvious symptom of a lack of convenient internal tools.
Why a Total Ban Only Makes Things Worse
The initial and most common reaction of traditional security services is to completely block access to popular public web interfaces. However, practice shows that strict restrictions are ineffective. Around 90% of organizations technically block at least one generative AI application, yet 47% of employees continue to use them at work anyway.
A mass phenomenon known as BYOAI (Bring Your Own AI) emerges in the corporate environment: the stealth use of personal, unmanaged accounts from smartphones or personal computers.
A total ban provides a false sense of security, as it reduces the visibility of the problem for management much faster than it reduces the actual use of technology. Meanwhile, critical data continues to leak outside the company perimeter:
- Source code;
- Financial statements and management spreadsheets;
- Personal data of customers and employees;
- Intellectual property and internal meeting minutes.
Target Architecture: The AI Gateway as a Control Tool
Instead of trying to halt progress, it is more profitable for businesses to offer their teams a convenient and secure alternative. The best choice in terms of the security-to-integration-speed ratio is a hybrid infrastructure layout.
The central element of such an architecture is the AI Gateway, which acts as a single point of entry and a control plane for all requests.
- Data Masking: the system automatically recognizes confidential information, trade secrets, or personal data within a prompt and masks it before the request is sent to external servers.
- Audit Logs: all incoming and outgoing requests are logged, allowing the IT department to conduct security audits in real time.
- Model Router: the gateway distributes tasks depending on the criticality of the data. Routine text tasks can be routed to external corporate models (e.g., via secure APIs), while work with sensitive information or state secrets is restricted to private local models (Local LLM) deployed within the company's isolated perimeter.
This approach allows for the seamless integration of AI into daily business scenarios. For example, during contract analysis, the system automatically replaces the personal data of counterparties with masks, and when working with internal knowledge bases, employee access rights (ACL) are strictly verified, preventing information leaks within the company itself.
How to Regain Control Over AI in 5 Steps
The process of bringing AI tools out of the shadows and into a manageable framework consists of five consecutive stages:
- See: conduct a technical audit and clearly understand which external AI services employees are already using to complete tasks.
- Divide: classify corporate information and differentiate use cases for working with various types of data.
- Block: set up automated rules and protection (Guardrails) to prevent critical data from being sent externally.
- Replace: launch official corporate access to secure alternatives so that employees have no reason to use personal accounts.
- Optimize: regularly analyze AI usage metrics to improve business processes and control infrastructure costs.
Checklist for Express Company Diagnostics
To assess your infrastructure's level of protection against Shadow AI risks, answer four simple questions:
- Do you know the exact list of AI tools your employees are using right now?
- Can your security service technically distinguish between the use of a personal AI account and a corporate one?
- Is there technical control over prompt submissions in your company, rather than just a regulation in a PDF format?
- Does the team have an official corporate AI tool that is actually convenient to use?
If you answered negatively to most of these questions, your company's infrastructure is in the risk zone. Transitioning to a hybrid model and implementing the AI Gateway from UzCloud will help safeguard commercial secrets without forced reductions in employee productivity. You can submit a request on our website.