Shadow AI is a growing concern, warn cyber security technology experts, as the world marks Cybersecurity Awareness Month.
As Cybersecurity Awareness Month is marked in October, cyber security companies and technology experts are warning of growing concerns about shadow AI – the use of AI tools without an organisation’s approval or oversight.
Richard Frost, head of technology solutions and consulting at Armata Cyber Security, says existing security teams and technologies were not designed to manage or monitor the growing use of shadow AI.
Frost cites PwC’s Insider Risk: Client Survey Insights 2026, according to which 0% of companies feel "very prepared for AI-driven insider risk”.
“Cloud has contributed to the threat sprawl as well because it has made almost everything external by default. E-mail sits in Microsoft 365 or Gmail, records are stored in platforms that are built and hosted by someone else, and each of these platforms and systems is another way into the business,” he adds.
Sophos recently announced the general availability of technology designed to identify AI tools used by employees and applications, including those that security teams have not approved, and to enforce policies across those tools. The company says it has seen increased interest from clients in shadow AI.
Bud Ellis, senior product marketing manager at Sophos, says the issue is already affecting organisations.
“Customers are asking how they can understand what AI is already being used across their environments, bring shadow AI into view, and put practical controls around that usage. Those conversations, combined with broader industry trends around rapidly expanding AI adoption, give us confidence that the need for AI security will continue to grow.”
Sophos cites a Gartner survey of 302 cyber security leaders conducted between March and May 2025, according to which 69% suspected or had evidence that employees were using unsanctioned AI agents and tools.
The company also refers to data from the Cloud Security Alliance, based on a survey commissioned by Token Security, according to which 82% of respondents had discovered shadow AI agents in their environments in the previous year.
The Komprise report IT Survey: AI, Data & Enterprise Risk, published on 3 June 2025, found that 90% of IT leaders were concerned about shadow AI risks. The survey covered 200 IT directors and executives at US enterprises with more than 1 000 employees.
IDC projects that there will be 1.3 billion AI agents by 2028.
According to Sophos, every AI tool an organisation cannot see is a potential gap in confidentiality, integrity and availability.
Vanessa Munnik-Wallace, Microsoft AI business solutions lead at Westcon-Comstor Southern Africa, says AI is already being used in South African organisations and that workers globally are experimenting with GenAI tools to work faster and more efficiently.
Munnik-Wallace cites a US survey conducted by Cybernews, which suggests that nearly 60% of employees admit to using AI tools that have not been formally approved by their organisations. Around three-quarters of those users say they have shared company information with those tools while working.
The risks associated with unregulated AI use have featured in high-profile cases. In 2023, Samsung temporarily banned employees from using GenAI tools after engineers unintentionally uploaded sensitive internal source code and meeting notes to ChatGPT while seeking assistance with their work.
For South African organisations, the issue is that AI tools are accessible to anyone with an internet connection and can be used in the workplace before formal policies are in place.
“The most effective way to reduce the risks associated with shadow AI is to provide employees with secure alternatives that allow them to use AI within the organisation’s technology environment," says Munnik-Wallace. "When AI tools are integrated into enterprise productivity platforms, they inherit the security, identity and compliance controls that are already in place. This allows employees to benefit from AI capabilities without exposing company data to unknown external systems."
Research released by Kaspersky in August found that 78% of South African SMEs had experienced a cyber security incident in the previous year, with weak or stolen login details accounting for 18% of incidents.
Kaspersky also recorded a tenfold increase in security vulnerabilities in AI services during the first half of 2026, most commonly involving access controls and authentication.
Veracode’s 2026 GenAI Code Security Report, released in July, found that leading AI models produced code containing a known security flaw in 44% of tasks where security was relevant.
Anton Moulder, head of product at software development firm HyperDev AI, says business owners can now use AI to build working applications in days, often without the technical knowledge needed to identify security weaknesses in the underlying code.
"That app could be holding customer names, phone numbers, booking details and, in some cases, payment information," he adds. "AI will build what you ask it to build, but if security isn't part of the brief, you can't assume it has been taken care of."
Moulder says this should not discourage small businesses from building applications.
"AI has put tools within reach that used to cost a development team and months of work. For a small business, that's a real advantage over bigger competitors. The businesses that hold onto it will be the ones customers trust with their details."
Ellis says Cybersecurity Awareness Month provides a timely opportunity to highlight a broader issue: organisations are trying to adopt AI while managing the security risks associated with its rapid uptake.
“Organisations still need to decide what AI use is acceptable, which tools they trust, what information employees should be permitted to share and who owns policy decisions and exceptions,” he adds. “Technology then helps make those policies visible and enforceable, rather than leaving them as written guidance.”