Somewhere in your organization this week, someone saved themselves a few hours by pasting company data into an AI tool nobody reviewed. They didn’t file a ticket, and they don’t think they did anything wrong.
It’s tempting to treat that as a policy violation. It’s more useful to treat it as information. Every unsanctioned AI tool in your environment is a feature request that never got filed. Someone just told you their work is too slow or too manual, and they told you for free.
The risk is real, and I’ll get to it. But start by asking how to stop this and you’ll mostly push it out of sight. Start by asking what people are trying to get done and you usually end up with better visibility and better controls.
The Policies Already Exist
Last December, RH-ISAC and IANS asked 201 retail and hospitality CISOs what was giving them the most trouble. AI beat out ransomware and phishing. And what worried them wasn’t a clever attack or a rogue model. Three out of four said their real fear was company data walking out through public AI tools.
Here’s what should bother us. In that same survey, only 3 percent of those organizations had no AI policy at all. Four out of five had a governance framework of some kind. The policies are written. Shadow AI is happening anyway.
So the thing holding us back isn’t a missing policy. It’s speed. When a team needs an answer in three days and your review takes three weeks, the tool wins. Not because anyone is being reckless, but because the approved option is to wait.
How It Shows Up
Most of what I run into falls into three buckets.
- Consumer tools carrying company data. People use personal or free accounts with customer records, internal reports, or pricing data. Cisco asked security and privacy professionals about this last year: almost half admitted to putting employee information into a generative AI tool, and a third had pasted in customer data. Free accounts often let the provider train on whatever you send.
- AI features inside tools you already approved. A forecasting platform adds summarization. A scheduling system ships an assistant. Nobody skipped review here, because there was nothing to review. The vendor was already on your list, and the data flow changed underneath it.
- Your own data teams experimenting. They evaluate models and test pipelines against production data. These tend to be your most capable people, working with your biggest datasets: guest and customer records, ID data from check-in, loyalty profiles.
Why It’s Hard to See
None of this means your DLP or CASB is broken. Those tools were built for a different kind of traffic.
DLP is good at catching sensitive data that has a recognizable shape and moves through a channel you’re watching, like a card number in an email attachment or an SSN copied to a USB drive. A prompt breaks every one of those assumptions. The data is usually retyped or reworded rather than copied, and it leaves as one web request with no file attached and no pattern your rules would catch.
CASB has a related blind spot. If your discovery runs off OAuth grants and a catalog of known apps, consumer AI services won’t register at all. There’s no grant into your tenant and no app to recognize. It looks like someone browsing the web.
Both can be extended, and vendors have shipped AI-specific detections. The catch is that none of it works out of the box, and most of us haven’t gotten around to turning it on.
Where You’re Exposed
- PCI DSS scope. This gets overstated, so to be precise: sending data to an AI service doesn’t automatically pull that provider into your cardholder data environment. What it does is make your paperwork wrong. Requirement 12.5.2 says your annual scope confirmation has to identify everywhere account data goes, including places outside the CDE you already mapped. An AI tool nobody wrote down isn’t on that list, and it isn’t on your data-flow diagram either. Easier to raise with your QSA than to have them find it.
- Your privacy disclosures. Under CCPA and similar laws, those disclosures say what personal information you collect and who you share it with. Send customer records to a service you have no contract with and they are no longer accurate. Depending on the data, that’s a conversation with counsel.
- Third-party risk that never got assessed. When a tool skips review, you don’t know who its subprocessors are, how long it keeps your data, or whether it will tell you about a breach. Same questions you ask every other vendor. Nobody asked them here.
What Actually Helps
I’d tackle these roughly in order.
- Build the front door before the fence. Start by making it easy to ask. That means a named channel, a short form, and a turnaround time you’ll actually hit. When a team brings you a tool they want to use, you won. Act like it. How that first conversation goes decides whether the next team bothers.
- Promise a fast turnaround and keep it. Two or three days, with the questions kept tight: what data does this touch, what do the terms say about training and retention, and is there a DPA? Anything touching regulated data goes to a longer review, and you say so upfront. You want the approved way to also be the fastest way.
- Ask people first, then go looking in the logs. Talk to teams directly, and be straight that you’re asking to help rather than to catch anyone, which only works if it’s true. A question like “what AI tools help you do your job, including personal ones?” will turn up things no network log will. Then fill in the gaps with what your tools can see: browser extensions, traffic to known AI domains, OAuth grants in your identity provider.
- Say what’s off limits. Most acceptable use policies were written before any of this existed. Instead of a blanket ban people will ignore, name the data that must never go to an unapproved service: cardholder and account data, government ID and passport data, anything that would trigger breach notification, and source code. Keep it to one page and write it for people who don’t work in security.
- Give people an approved option. This is the step most often skipped, and it does more than the other four put together. Put enterprise tooling with decent contractual terms in front of the teams already using the consumer version, and the reason for shadow AI mostly goes away. Governance without an alternative is just asking people to be worse at their jobs, and they won’t do it.
Where to Start
If you do one thing after reading this, go talk to three teams. Ask which AI tools they use and what those tools do for them, and be clear you’re asking because you want to help. A week of that will tell you more than a quarter of log analysis, and you’ll know which of the five steps above you need first.
I’ll be presenting on this at the RH-ISAC Regional Workshop in New Jersey on 16 September. I talk to retail and hospitality teams about shadow AI most weeks, so I see a lot of these environments from the outside while you know one of them from the inside. If you want to check what you’re finding against what I’m seeing elsewhere, come find me.
Cheng Ren is Principal Solutions Engineer at Onyx Security. This post is educational in nature and does not constitute a product endorsement.
