How to Manage the Security Risks of Unsanctioned AI in the Workplace

Today's AI security challenge reminds me of the Bring Your Own Device (BYOD) revolution of the late 2000s. Back then, employees connected personal smartphones and tablets to corporate networks, creating security and data-loss risks organisations had never anticipated.

Fast forward to today and AI has only amplified the problem. If it was risky having personal devices connected to your network, then uploading confidential documents to unsanctioned LLM's takes the problem to a whole new level. Every prompt has the potential to leak data as customer information, intellectual property, source code, financial data, and confidential business plans are shared with AI services outside corporate governance controls.

At the same time, the speed of AI adoption is outpacing security policies, leaving your security teams struggling to assess risks, enforce controls, and maintain compliance. Twelve months ago, people were experimenting with chatbots. Today, they can build AI agents capable of accessing files, searching internal systems and triggering actions across multiple applications with little or no coding skills. Unsanctioned AI introduces regulatory and compliance challenges, and without visibility into how data is processed, stored, or used by third-party AI, organisations will face increased exposure to privacy, regulatory, and contractual risks. Trying to protect everything all at once presents its own challenges, so it's no wonder nearly half of UK companies report that their main challenge is protecting their business against increasing security risks.

What's the solution to unsanctioned AI use?

The AI genie is out of the bottle and granting everyone in your organisation as many wishes as they want. It's time to accept the attack surface is expanding and focus your energy on three areas: strategy, execution and persistence.

Developing a strategy for unsanctioned AI use

A good AI security strategy begins with understanding how AI is already being used. Many organisations try to write policy before they understand behaviour, but effective governance begins with visibility.

Visibility begins when you have the answer to these three questions:

1. Do we know which AI tools employees are using today?
2. Can we identify where sensitive business information is being shared with AI?
3. Do people have access to approved AI tools that are good enough to discourage the use of unsanctioned alternatives?

The answers provide a realistic picture of where AI is creating value, where it introduces unacceptable risk, and where controls are needed. Procurement may have very different requirements from Finance or Software Engineering, so governance needs to reflect those differences rather than offering blanket rules.

Finally, strategy should define what good looks like: which AI platforms are approved, what data can be shared, how new AI tools are evaluated, and who owns ongoing governance. Good strategy isn't about slowing AI adoption. It's about ensuring innovation happens inside the guardrails rather than outside them.

From unsanctioned to approved AI use

Most employees are not deliberately bypassing security; they're simply trying to save time by automating repetitive tasks. The problem is that productivity wins over policy when secure alternatives aren't available. The better approach is to make the secure option the easiest option.

Employees need to be offered approved solutions that are easy to access, simple to use and capable enough that they don't feel the need to look elsewhere. That means combining technical controls with practical governance.

AI use requires ongoing governance

Unlike previous waves of technology, AI evolves almost daily. New models, integrations and autonomous capabilities appear faster than most organisations can review policies, let alone enforce them.

Persistence means treating AI governance as an ongoing programme rather than a one-off project. Security teams need regular reviews of emerging tools, continuous employee education, and governance that evolves alongside the technology.

Leadership also has an important role. Employees will follow what leaders do far more readily than what policies say. When executives demonstrate responsible AI use, discuss risks openly and encourage questions, they help create a culture where innovation and security reinforce one another instead of competing.

Next steps for organisations to take

The BYOD challenge eventually became manageable because organisations developed the right policies, technologies and ways of working. I believe AI will follow the same path; the difference is that organisations don't have years to adapt. 

Putting the ideas I’ve discussed above into practice requires experience and the right security ecosystem.

No two organisations have the same digital DNA. That’s why our cyber security team takes a discovery-led approach that prioritises your specific business context. 

• Learn more about our cyber security solutions by reading our eBook, Delivering digital continuity in an unpredictable world.
• Request a free cyber security discovery session and we’ll identify clear opportunities to strengthen your organisation's resilience.