Gen AI and shadow IT: The secrets enterprises need to know

The rise of generative AI has introduced a new wave of shadow IT challenges for enterprises. As employees increasingly use AI tools outside official IT channels, organizations face significant risks including data leaks, compliance violations, and security breaches. This article explores how generative AI is reshaping shadow IT, the dangers it poses, and strategies for enterprises to manage and secure AI-driven shadow IT effectively. Generative AI tools, while boosting productivity and innovation, often operate beyond the purview of corporate IT departments. This lack of oversight creates blind spots where sensitive data can be inadvertently exposed or misused. Enterprises must understand the scope of AI shadow IT to implement robust governance frameworks that balance innovation with security. Key risks associated with generative AI shadow IT include unauthorized data sharing, potential introduction of malware through unvetted AI applications, and compliance risks related to data privacy regulations. Organizations need to adopt comprehensive monitoring and control mechanisms to detect and mitigate these threats promptly. To address these challenges, enterprises should invest in employee training to raise awareness about the risks of unsanctioned AI tool usage. Additionally, integrating AI governance into existing cybersecurity policies and leveraging advanced threat detection technologies can help maintain control over AI-driven shadow IT environments. In conclusion, while generative AI offers transformative potential, its shadow IT implications require proactive management. Enterprises that effectively govern AI shadow IT will not only safeguard their data but also harness AI's benefits securely and responsibly.

This Cyber News was published on www.theregister.com. Publication date: Tue, 07 Oct 2025 22:14:03 +0000


Cyber News related to Gen AI and shadow IT: The secrets enterprises need to know

You Don't Know Where Your Secrets Are - Do you know where your secrets are? If not, I can tell you: you are not alone. Hundreds of CISOs, CSOs, and security leaders, whether from small or large companies, don't know either. No matter the organization's size, the certifications, tools, ...
2 years ago Thehackernews.com
Securing the code: navigating code and GitHub secrets scanning - Enter the world of GitHub secrets scanning tools, the vigilant sentinels of your digital gala. Secrets scanning in GitHub is anchored by two fundamental strategies: proactive prevention and reactive detection, each serving a critical function in ...
1 year ago Securityboulevard.com
Shadow AI poses new generation of threats to enterprise IT - Unsanctioned AI, also known as shadow AI, poses even more challenges. Shadow AI is just like every other stripe of shadow IT - unsanctioned technology that corporate employees deploy ad hoc and use in ways unknown to or hidden from an organization's ...
1 year ago Techtarget.com
Gen AI and shadow IT: The secrets enterprises need to know - The rise of generative AI has introduced a new wave of shadow IT challenges for enterprises. As employees increasingly use AI tools outside official IT channels, organizations face significant risks including data leaks, compliance violations, and ...
1 day ago Theregister.com
How to Eliminate Shadow IT and Achieve a Secure SaaS Environment in 2023 - The prevalence of Shadow IT has grown exponentially over the years, with most organizations being unaware of the security risks of unauthorized cloud applications. Shadow IT is any application or cloud service being used by employees for business ...
2 years ago Thehackernews.com
Eight emerging areas of opportunity for AI in security - That's core to the thesis of how Menlo Ventures chose to evaluate eight areas where gen AI is having an outsized impact. They have collaborated on a series of blog posts that illustrate why closing the security for AI gaps is crucial for generative ...
1 year ago Venturebeat.com
Privileged Access Management for DevOps - Recently, KuppingerCole released the first edition of its Leadership Compass for Privileged Access Management for DevOps. The KuppingerCole report recognizes the unique and complex challenges that exist in DevOps and other dynamic environments. The ...
2 years ago Beyondtrust.com Patchwork
Honeytokens for Peace Of Mind - If you have been tackling the realities of secrets sprawl, getting a handle on all the hardcoded credentials in your organization, then we understand the stress and the restless nights that can bring. Even a small team can add hundreds of secrets a ...
1 year ago Feeds.dzone.com
Over 12 million auth secrets and keys leaked on GitHub in 2023 - GitHub users accidentally exposed 12.8 million authentication and sensitive secrets in over 3 million public repositories during 2023, with the vast majority remaining valid after five days. The exposed secrets include account passwords, API keys, ...
1 year ago Bleepingcomputer.com
CVE-2021-47553 - In the Linux kernel, the following vulnerability has been resolved: sched/scs: Reset task stack state in bringup_cpu() To hot unplug a CPU, the idle task on that CPU calls a few layers of C code before finally leaving the kernel. When KASAN is in ...
1 year ago Tenable.com
GitHub expands security tools after 39 million secrets leaked in 2024 - Standalone Secret Protection and Code Security – Now available as separate products, these tools no longer require a full GitHub Advanced Security license, making them more affordable for smaller teams. GitHub announced updates to its Advanced ...
6 months ago Bleepingcomputer.com
GitGuardian Report: 70% of Leaked Secrets Remain Active for Two Years, Urging Immediate Remediation - GitGuardian, the security leader behind GitHub’s most installed application, today released its comprehensive “2025 State of Secrets Sprawl Report,” revealing a widespread and persistent security crisis that threatens organizations ...
6 months ago Cybersecuritynews.com
Entro Security Newest Competitor in 2024 'ASTORS' Awards Program - Secrets management and monitoring are crucial components of any security program. Entro is a holistic secret security platform designed specifically for security teams and CISOs. To ensure that doesn't happen, Entro offers an exclusive secrets ...
1 year ago Americansecuritytoday.com
Omdia: Standalone Security Products Outsell Cybersecurity Platforms - In its many briefings with cybersecurity vendors, one of the most consistent themes Omdia hears is why enterprises need cybersecurity platforms. Instead, vendors claim, enterprises could get better outcomes if they give up their multitude of ...
1 year ago Darkreading.com
new detectors, your favorite features, and what's coming next in GitGuardian - GitGuardian Secrets Detection More detectors = more secrets caught. Every detector has its comprehensive ID card in the public documentation, outlining the secret type, its intended usage and scope, and detailed steps for revocation. If you haven't ...
1 year ago Securityboulevard.com
The Secret Weakness Execs Are Overlooking: Non-Human Identities - By shifting our focus to secrets security and adopting a comprehensive approach that includes robust detection, automated remediation, and integration with identity systems, organizations can significantly reduce their attack surface and bolster ...
1 year ago Thehackernews.com
CVE-2024-28236 - Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a ...
1 year ago
What Lurks in the Dark: Taking Aim at Shadow AI - Security teams are confronting a new nightmare this Halloween season: the rise of generative artificial intelligence. Generative AI tools have unleashed a new era of terror for chief information security officers, from powering deepfakes that are ...
1 year ago Darkreading.com
Kubernetes Security: Sensitive Secrets Exposed - Cybersecurity researchers are warning of Kubernetes security issues amid the exposure of configuration secrets. Researchers believe that such attacks could be orchestrated using Kubernetes secrets exposed in public repositories as they allow access ...
1 year ago Securityboulevard.com
CVE-2025-21632 - In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are ...
8 months ago Tenable.com
Tracking Everything on the Dark Web Is Mission Critical - COMMENTARYOne of the standard cybersecurity tools today is to relentlessly check the Dark Web - the preferred workplace for bad guys globally - for any hints that your enterprise's secrets and other intellectual property have been exfiltrated. It ...
1 year ago Darkreading.com Equation
Doppler Launches 'Change Requests' to Strengthen Secrets Management Security with Audited Approvals - Doppler, the leading platform in secrets management, today announces the launch of Change Requests, a new feature providing engineering teams with a secure, auditable approval process for managing and controlling secret changes across environments. ...
1 year ago Cybersecuritynews.com
Employee Use of 'Shadow IT' Elevates Cyber Attack Risks for Indian Firms - In India, a recent report indicates that approximately 89% of companies faced cyber incidents within the past two years. Alarmingly, 20% of these breaches were attributed to the utilization of shadow IT, as per findings from a study. This surge in ...
1 year ago Cysecurity.news
How enterprises are using gen AI to protect against ChatGPT leaks - ChatGPT is the new DNA of shadow IT, exposing organizations to new risks no one anticipated. Enterprise workers are gaining a 40% performance boost thanks to ChatGPT based on a recent Harvard University study. A second study from MIT discovered that ...
1 year ago Venturebeat.com
GitGuardian Launches MCP Server to Bring Secrets Security into Developer Workflows - GitGuardian, the leader in automated secrets detection and remediation, today announced the launch of its Model Context Protocol (MCP) Server, a powerful new infrastructure designed to bring AI-assisted secrets security directly into developer ...
2 months ago Cybersecuritynews.com

Cyber Trends (last 7 days)