Shadow AI Is Used Despite Known Risks... Fasoo AI Says Visibility Is Needed for Risk Management

Inside companies, the use of personal accounts without internal approval and unauthorized external generative AI tools for work is spreading, making shadow AI a new security threat. Experts say it is urgent to establish clear policies and guidelines on AI use and provide safe in-house AI tools in response. Fasoo AI said visibility is needed for risk management.

Fasoo AI released a survey-based report on the 28th. The report is titled "Intelligence Out of Control - The State of Shadow AI Use and Response in Domestic Organizations." The survey covered 151 AI, IT, and security personnel at major domestic companies and institutions.

According to the survey, the No. 1 form of AI use within organizations was voluntary use without separate rules, at 29.1%. The No. 2 was allowing only designated generative AI services, at 22.5%, followed by in-house development and operation of proprietary AI at 17.9%. The share of organizations that in principle block use was 14.6%. However, the share of respondents saying they currently use generative AI through personal accounts during work was 88.7%.

Fasoo AI analyzed that an organizational ban on generative AI alone makes it difficult to block employees' personal account use. Even among groups that said generative AI use is, in principle, blocked, the shadow AI usage rate was 77.3%.

This trend was also linked to awareness of the risks of using unauthorized AI tools inside companies for work. The key issue was security, and companies were aware of the risks of using unauthorized AI tools inside the company for work. Despite that awareness of risk, most were found to be using shadow AI. However, according to the report, only 19.2% of organizations were found to be identifying and controlling the current use of AI through employees' personal accounts.

The biggest concern related to shadow AI was the use of internal core data to train third-party models, accounting for 28.3%. Major concerns also included violations of regulations such as the Personal Information Protection Act and GDPR, at 24.0%, and difficulty responding to incidents because usage history cannot be tracked, at 23.7%.

According to the survey, the biggest reason employees use shadow AI was the lack of clear usage policies and guidelines, accounting for 28.5%. That was followed by avoiding leaving usage records on company accounts or systems, at 25.3%, in second place. Other reasons included weak in-house AI performance at 19.9%, the lack of approved AI tools at 14.6%, and cumbersome application and approval procedures at 11.7%.

Sohn Jong-gon, executive director at Fasoo AI, said the survey confirmed that shadow AI is difficult to block through bans alone. He said the key response measures are clear policies, provision of safe alternatives, and visibility into AI usage.

Source: TECHWORLD · Kim Hye-jin
Original: https://www.epnc.co.kr/news/articleView.html?idxno=408916

References

• https://www.epnc.co.kr/news/articleView.html?idxno=408916