Shadow AI still a problem—but the solution isn’t punishment

What AI lurks in the heart of the tech stack? The shadow knows—shadow AI.

A new report from AIOps platform PagerDuty shows that 66% of office professionals are misusing tools at work, adding to an existing problem that’s plaguing enterprises across industries.

Company policies don’t seem to be dissuading the practice. PagerDuty found that 72% of professionals believe they understand how to use AI better than their organization’s IT teams.

It’s a challenge on a number of levels, PagerDuty CIO Eric Johnson told IT Brew, and one that’s getting worse.

“The pace and power of what we’re dealing with now is different,” Johnson said. “These tools are incredibly powerful, and the adoption and sophistication of what you can do with these tools is far surpassing anything I’ve ever seen.”

Be careful. In that context, deploying AI that doesn’t meet internal policies presents significant challenges. Employees thinking they know better than IT leaders can only add to the problem.

Easier said than done, it’s important to address with staff that these tools are not magic, as Ido Gaver, Sweep.io CEO and co-founder, said in October.

“Technical teams know how difficult their job is, and the reality is that to build AI tools that are making their job easier is also very, very difficult,” Gaver told IT Brew. “If someone tells you that AI is magic, don’t buy into it; it’s a lot of hard work to build a tool.”

Employees sharing work-related information with LLMs is particularly dangerous: The PagerDuty report found that 88% of office pros input sensitive information into unauthorized AI tools.

Adjustment time. Some 89% of employees said they began using AI at home before porting the practice to work. Given their need to engage with AI in both personal and professional contexts, it’s important to offer realistic and manageable expectations around the latter. Johnson told IT Brew that he sees education as an essential path forward, because punitive measures haven’t worked as effectively. And education goes both ways.

“If you see a piece of technology that your employees are bringing into the environment at a pretty rapid pace, you need to take notice, and not in a police-state sort of mentality, but more in a seek-to-understand mentality,” Johnson said.

That tracks with what IT Brew has found. As Will Adams, president of pipIQ, told us in April, it’s better to find out what works for staff and then adjust to their preferences: “Companies have to be able to create a very similar experience for the employees, and the only way to do that is to understand what they’re doing.”

While it’s a delicate balance, Johnson believes that there’s a way to match existing enthusiasm with caution.

“A lot of it is just listening to the employees, understanding what they’re doing when it comes to shadow IT, seeing where there’s opportunity to bring some of that into the organization,” Johnson said. “That helps to continue to create excitement, and as an IT person, you want that—you want people to be excited about the tools and technologies that are available to them.”