Even When the Boss Says Not to Use AI, 77% Use It in Secret... A Blind Spot in Corporate Security

[Financial News] A new assessment has found that even when companies ban the use of generative artificial intelligence (AI), it is difficult to stop employees from using AI through personal accounts. Even at organizations that have blocked AI use, 77% of respondents use AI through personal accounts. This has prompted calls for greater visibility into AI use and stronger management systems to reduce security threats.
On the 28th, Fasoo AI released a report titled “Intelligence Beyond Control: The State of Shadow AI Use and Responses in Korean Organizations,” based on a survey of 151 AI, information technology (IT) and security professionals at major companies and institutions in South Korea.
Shadow AI refers to generative AI that employees use for work without their organization’s approval or oversight. The survey found that 15% said their organization blocked the use of generative AI in principle. However, even in this group, 77% used generative AI through personal accounts. Overall, 89% of respondents said they used AI through personal accounts for work.
Only 19% of organizations tracked and controlled employees’ use of AI through personal accounts. The main concerns about shadow AI included internal core data being used to train third-party models; violations of regulations such as South Korea’s Personal Information Protection Act and the European Union’s General Data Protection Regulation (GDPR); and difficulty responding to incidents because usage histories could not be tracked.
The most commonly cited reason for shadow AI use, at 29%, was the lack of clear usage policies or guidelines. Other major reasons included avoiding a usage history being left in company accounts or systems and compensating for the limited performance of in-house AI tools. 
The most commonly cited measure to reduce security risks, at 26%, was providing secure in-house AI tools. Other key measures included improving visibility into AI use, establishing clear usage policies and guidelines, and introducing technology to control sensitive information at the prompt-entry stage.
Jong-gon Son, a managing director at Fasoo AI, said, “This survey shows that shadow AI is difficult to prevent through bans alone. The key is to provide clear policies and safe alternatives, and to ensure visibility into AI use.” He added, “We plan to launch soon an AI security platform that comprehensively manages various data leakage channels and provides visibility across AI use.”
[email protected] Choi Hye-rim Reporter