The challenge facing organisations is no longer whether employees are using unauthorised AI tools, but how businesses govern that reality.
As AI becomes part of everyday work, cybersecurity professionals are urging organisations to replace reactive restrictions with practical governance that gives employees access to approved AI platforms, establishes clear policies for responsible use, and protects sensitive information through appropriate technical and organisational controls.
IITPSA SIGCyber consultants argue that most employees adopt AI to work more efficiently rather than to circumvent security policies. However, without clear governance, organisations can lose visibility into how business information is being processed, increasing the risk of data leakage, regulatory breaches and reputational harm.
Professor Kerry-Lynn Thomson, Director of the School of Information Technology at Nelson Mandela University, says organisations should recognise that Shadow AI is primarily a governance challenge rather than simply a technology problem.
"Shadow AI risks often do not originate from malicious intent and the use of AI tools to improve productivity is primarily driven by the good intentions of employees. However, employees may upload sensitive data such as customer information, intellectual property or internal documents into public AI platforms without understanding where that data is stored, how it is processed or who may ultimately be able to access it."
She says organisations should focus less on restricting AI and more on creating a culture of responsible use.
"Addressing Shadow AI should not only be focused on restricting access to AI tools. Organisations should cultivate a culture of AI risk awareness, ethical use and trust, where employees are guided on how to use AI tools to reduce risk."
Bryan Baxter, Head of Securelytics at BC Technologies, believes organisations should accept that employees will continue to seek AI tools unless secure alternatives are available.
"If approved platforms are not provided, employees will use AI anyway, as surely as water flows downwards."
He recommends that organisations establish acceptable AI use policies covering approved platforms, acceptable use, prohibited activities, data protection requirements and risk mitigation measures, supported by ongoing employee education.
"The best way to deal with it is to engage openly with employees, educate them and obtain their buy-in to develop a culture to safely adopt AI in the business."
Mandla Mbasane, Chief Information Security Officer at the National Housing Finance Corporation, says governance must extend beyond policy documents to include technical controls and information management practices.
"Organisations need to define AI policies and governance processes that align with companies' environment and goals."
He says AI governance should be integrated with Bring Your Own Device (BYOD) policies, supported by Data Loss Prevention (DLP) technologies and aligned with data classification frameworks.
"User awareness can never be overemphasised. Organisations need to regularly run campaigns to empower employees with information pertaining to the dangers of using AI in contravention of company policies."
An anonymous contributor, the CTO of a Johannesburg-based multi-site contact centre group, says many organisations may underestimate the scale of unauthorised AI use until they examine their own network traffic.
Following a routine review of AI-related firewall activity, the organisation identified dozens of different AI platforms in active use across the business. While the example reflects one organisation's experience, the contributor says it demonstrates why visibility is the first step in effective governance.
The IITPSA SIGCyber committee contributors encourage organisations to begin by understanding which AI services are being used across their environments before implementing risk-based governance that distinguishes between approved, conditionally approved and prohibited tools. Combined with employee awareness, data protection controls and clear governance, this approach allows organisations to realise the productivity benefits of AI while managing associated cybersecurity and compliance risks.
