CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Unsanctioned AI Tool Usage in Enterprises

First reported
Last updated
2 unique sources, 2 articles

Summary

Hide ▲

Over 80% of employees now use unapproved generative AI applications at work, with only 12% of companies maintaining formal AI governance policies. Shadow AI activity primarily occurs through OAuth connections to corporate data, browser extensions, and AI features embedded in pre-approved tools. This unsanctioned usage bypasses traditional security controls, creating significant governance and data exposure risks. Enterprises struggle to balance productivity with security, as employees adopt AI tools 3–5 times daily without IT oversight. The EU AI Act’s mandate for AI system visibility has intensified the need for continuous monitoring and risk assessments. Solutions like Harmonic Security’s platform enable enterprises to enforce smart governance policies based on data sensitivity, employee roles, and tool nature, addressing the operational realities highlighted by recent research.

Timeline

  1. 02.09.2025 14:30 2 articles · 8mo ago

    Harmonic Security Introduces Shadow AI Discovery for Enterprise Governance

    Harmonic Security’s solution provides continuous monitoring and risk assessments for sanctioned and unsanctioned AI tools, enabling precise governance and compliance with regulations like the EU AI Act. This remains the foundational development for managing shadow AI in enterprises, as confirmed by broader industry practices and research.

    Show sources
    Open in new tab

Information Snippets

Similar Happenings

Rising Threat of AI Browser Extensions as Enterprise Attack Surface Exposed

A new study reveals AI browser extensions as a rapidly expanding, under-monitored attack vector in enterprise environments. These extensions bypass traditional security controls by operating within the browser, granting direct access to user inputs, session cookies, and rendered page content. Enterprise adoption is nearly universal—99% of users install at least one extension—with AI extensions displaying disproportionately high risk profiles, including elevated vulnerability rates, increased permission escalations, and ungoverned access to sensitive data. The lack of visibility and governance creates an unmonitored channel for data exfiltration, session hijacking, and policy evasion, particularly as AI tooling becomes embedded directly into browsing workflows.

Open in new tab

Nudge Security Introduces AI Governance and Monitoring Solution

Nudge Security has launched a solution to help organizations discover, monitor, and govern the use of AI tools within their environments. The tool provides continuous discovery, real-time monitoring, and proactive governance to mitigate risks associated with shadow AI usage. The solution integrates with identity providers (IdP) like Microsoft 365 and Google Workspace to detect AI tool adoption and monitor sensitive data sharing. It also offers alerts for risky activities and enforces AI usage policies. This development addresses the growing challenge of managing AI tools that are often adopted without IT oversight, posing potential security and compliance risks.

Open in new tab

AI Governance Strategies for CISOs in Enterprise Environments

Chief Information Security Officers (CISOs) are increasingly tasked with driving effective AI governance in enterprise environments. The integration of AI presents both opportunities and risks, necessitating a balanced approach that ensures security without stifling innovation. Effective AI governance requires a living system that adapts to real-world usage and aligns with organizational risk tolerance and business priorities. CISOs must understand the ground-level AI usage within their organizations, align policies with the speed of organizational adoption, and make AI governance sustainable. This involves creating AI inventories, model registries, and cross-functional committees to ensure comprehensive oversight and shared responsibility. Policies should be flexible and evolve with the organization, supported by standards and procedures that guide daily work. Sustainable governance also includes equipping employees with secure AI tools and reinforcing positive behaviors. The SANS Institute's Secure AI Blueprint outlines two pillars: Utilizing AI and Protecting AI, which are crucial for effective AI governance.

Open in new tab

Google Chrome Enterprise Premium Enhances Browser Security for Hybrid Work Environments

Google's Mark Berschadski discussed how Chrome Enterprise is evolving to address the complex security challenges of today's rapidly changing business landscape at the "There's No Place Like Chrome" event. The traditional workplace perimeter has dissolved, leading organizations to pivot to browser-based security to enable work from any device, anywhere. Chrome Enterprise Premium supports zero trust security principles through identity verification, device posture assessment, and continuous verification. It allows organizations to implement granular security policies while maintaining a seamless user experience, making it essential for securing hybrid work environments. Kemmerer and Hudziak addressed common misconceptions about browser security, noting that traditional solutions like VPNs and firewalls often fail in BYOD scenarios. Chrome's extensive telemetry and security features, including Safe Browsing and advanced malware sandboxing, provide IT and security teams with the tools needed to monitor and mitigate risks effectively. The threat landscape is evolving with attackers increasingly targeting human vulnerabilities through social engineering rather than technical exploits. Google Safe Browsing alerts users if they click on a site known or suspected to be involved in nefarious activities, and administrators can prevent access to such sites. Chrome Enterprise and Chrome OS enable security controls at the browser level, allowing for verification of device status, user identity, access rights, and data handling. Chrome Enterprise includes Data Loss Protection (DLP) controls that manage file downloads, printing, and uploads to safeguard intellectual property. It supports secure interactions for third-party contractors and BYOD environments. Google is integrating productivity-enhancing AI capabilities like Gemini into Chrome for enterprise customers later this year, transforming the browser into a secure, productive workspace with customizable controls that adapt to changing organizational needs while effectively managing risk.

Open in new tab

BigID Launches Shadow AI Discovery to Address Unauthorized AI Models and Risky AI Data

BigID has launched Shadow AI Discovery, a new capability designed to help organizations identify unauthorized AI models and high-risk datasets. This tool aims to reduce AI exposure across enterprises by providing visibility into unmanaged models, flagging sensitive training data, and mapping AI usage. Shadow AI Discovery integrates with various platforms to offer a comprehensive view of an organization's AI footprint and enables security teams to enforce policies and remediate risks. Shadow AI poses significant risks, including data leakage, IP misuse, and regulatory violations. Traditional security tools often overlook these risks, leaving organizations vulnerable. Shadow AI Discovery addresses this gap by providing actionable insights and control measures to mitigate AI-related threats.

Open in new tab