The most dangerous person in your business for cyber security probably isn’t a hacker. It’s Karen from Accounts.
Karen isn’t doing anything wrong on purpose. It’s 3:45pm, payroll is due at 4, and the spreadsheet is a mess. So she pastes 200 rows of names, salaries and National Insurance numbers into a free AI chatbot and asks it to tidy them up. Thirty seconds later, job done.
She saved herself an hour. She also just sent your staff data to a company you’ve never signed a contract with.
What is Shadow AI?
Shadow AI is any AI tool your staff use without the business knowing about it or approving it. It’s the same old shadow IT problem, just faster, because most AI tools are free and take seconds to sign up to.
It usually looks like one of these:
- Free chatbots used with a personal login, outside your company account
- Browser extensions that read whatever is on the page to “help”
- AI note-takers that join meetings and store the recordings somewhere else
- AI features quietly switched on inside apps you already pay for
Why it matters
The problem isn’t AI. The problem is not knowing where your data has gone.
When staff use an unapproved tool, your data leaves your Microsoft 365 environment. There’s no audit trail, no contract and no control over how long it’s kept. Some free tools may also use what you type to improve their models unless someone has changed the settings.
Think about what gets pasted in on a normal day:
- Payroll and National Insurance numbers
- Client contracts and pricing
- Customer lists and email threads
- HR notes and grievances
If that data belongs to your clients or staff, you’re still responsible for it under GDPR. “Karen used a chatbot” isn’t going to be a great answer if something goes wrong.
What we’re seeing behind the scenes
This month we started reporting on AI tool usage across the businesses we look after. Not guesses, actual data: which AI tools are being used, on which device, by which user.
We’ve been careful to keep it accurate. Nobody wants an alert every time someone opens a website. The point is a clear picture, not a witch hunt.
It also ties into something else we found. While checking accounts, we spotted 46 personal Microsoft accounts registered with work email addresses. Each one sits outside the company’s security policies. Same pattern: well-meaning staff, invisible risk.
Next we’re rolling out controls to block unapproved AI tools and stop sensitive data, like National Insurance numbers, being copied into them in the first place.
What to do about it
Banning AI outright doesn’t work. People just use it on their phones instead. Give them a safe option and they’ll use that.
- Find out what’s being used. You can’t manage what you can’t see.
- Pick your approved tools. If you’re on Microsoft 365, Copilot works inside your own environment, so your data stays where it belongs.
- Write a one-page AI policy. What’s allowed, what’s not, and what never gets pasted in.
- Talk to your team. Explain the why. Nobody wants to be the next Karen.
- Add guardrails. Block the risky tools and stop sensitive data leaving.
- Check again every quarter. New AI tools appear every week.
How we handle it at West View IT
Shadow AI reporting is now part of our standard service for every client. It isn’t an add-on and it doesn’t change your price. Security is included as standard, and this is just the latest piece.
We work only with Microsoft 365, so we can lock things down properly and give your team approved AI tools that keep your data inside your business.
Want to know what AI tools your team is really using? Call us on 01449 798119 or visit westviewit.co.uk. We’ll show you what Karen’s been up to.
