XM Cyber Finds 80% of Companies Show Signs of Unapproved AI Activity
“AI is not happening in the shadows because people are trying to break the rules. It is happening because people are trying to do their jobs better.”
This sentence captures the essence of the discussion Microserve hosted at the Victoria Privacy & Security Summit 2026, where leaders from Microserve, SentinelOne, and the University of Northern British Columbia sat down to unpack a reality many organizations are only beginning to recognize:
Shadow AI is already here.
Not as a future risk or fringe behavior, but as an everyday part of how work gets done.
The real question is no longer how do we stop it, but how do we guide employees’ behaviours while building trust, transparency, and productivity?
The Moment Shadow AI Became Real
For years, IT teams have dealt with Shadow IT. Employees using tools without approval. Files shared outside official systems. Apps installed without oversight.
But Shadow AI feels different. “It feels like it happened overnight”, shared Elie Nasrallah, Principal Sales Engineer at SentinelOne.
In reality, it did not. But the speed of adoption did.
Suddenly:
- Developers are debugging code with AI
- Marketing teams are generating content in seconds
- Analysts are summarizing reports instantly
- Employees are pasting sensitive data into chat tools without hesitation
But for most organizations, their IT team does not have insights into these unsanctioned AI tools.
What Shadow AI Actually Looks Like Inside Organizations
There is a common misconception that Shadow AI is rogue behavior. However, it is often the result of lack of AI governance and employees seeking to address a want or need.
“They are not choosing these tools to create risk. They are choosing them to solve a need.” Christopher Ross, Chief Information Security and Privacy Officer, UNBC
That distinction matters.
Because if you treat Shadow AI as misconduct, you shut down the conversation.
But if you treat it as signal, you gain insight into what people within your organization actually need.
The Hidden Risk of Shadow AI
Here is where things get serious.
When AI tools are used without visibility, organizations lose control over:
- Sensitive data
- Intellectual property
- Customer information
- Regulated data like health or payment details
And the most dangerous part?
You often do not know what was shared.
“Organizations don’t have a clear view of what is being used… and what is being lost.”
There is no undo button.
No rollback.
No way to pull data back once it is exposed.
One example discussed during the session highlighted how even a simple act like debugging code using an AI tool can unintentionally expose proprietary information permanently.
Why Blocking AI Is the Wrong Strategy
The instinctive response for many organizations is simple:
Block it. Restrict it. Control it.
But this approach creates a bigger problem as Christopher Ross, Chief Information Security and Privacy Officer at the University of Northern British Columbia, pointed out: “a one size fits all approach contributes to your shadow AI culture.”
When employees feel unsupported:
- They go around IT
- They hide their usage
- They experiment without safeguards
And Shadow AI grows deeper roots.
A Better Approach: Bring It Into the Light
Instead, Chris offered an alternative on how he and his team handled shadow AI at UNBC:
“We are not the department of no. We are the department of how can we help protect everyone.”
With this mindset shift, instead of policing behavior, blocking tools, or creating a culture of total surveillance, Chris suggested organizations to enable safe experimentation, build trust, and guide usage.
The Real Starting Point: Visibility
Before governance, before policy, before strategy…
You need to answer one simple question:
What AI tools are being used today?
As Elie suggested, timing is key: “Start now. Build visibility of what is going on.”
Without visibility:
- You cannot assess risk
- You cannot protect data
- You cannot guide behavior
And most importantly:
You cannot build trust.
Trust Is the Foundation of AI Governance
One of the most important themes from the discussion was monitoring does not mean surveillance.
Employees fear:
- Being watched
- Having their work tracked
- Losing autonomy
But governance done right looks very different.
It is:
- Transparent
- Communicated clearly
- Built with employees, not imposed on them
“We are not logging every keystroke… once policies are clear, adoption becomes easier.”
Trust turns Shadow AI from a hidden risk into a shared responsibility.
The Role of Conversation (Yes, Even Coffee Chats)
One of the most practical insights from the session had nothing to do with technology.
It was about conversation.
“Some of the most valuable insights come from informal discussions.”
- Not workshops.
- Not compliance sessions.
- Not policy documents.
Just conversations.
What happens when you ask people:
- “Are you using AI?”
- “What are you using it for?”
- “What problem are you trying to solve?”
You uncover:
- Real use cases
- Hidden risks
- Opportunities for improvement
And something even more valuable:
Trust.
Why AI Adoption Is Different This Time
One surprising insight from the panel:
Even people who usually resist change are adopting AI.
“The willingness to adopt AI was much more widespread than other forms of technology.”
That includes:
- Employees who resisted past tools
- Users who avoided system upgrades
- Teams that typically push back on change
AI is not optional anymore.
It is becoming:
- A productivity tool
- A competitive advantage
- A baseline expectation
Governance That Actually Works
So what does effective AI governance look like?
Not rigid policies.
Not a single approved tool.
But a living framework that includes:
1. Cross Functional Collaboration
Bring together:
- IT
- Security
- Legal
- HR
- Business teams
2. Clear Guardrails
Define:
- What data can be used
- What tools are approved
- What risks exist
3. Practical Education
Explain risks in a way that makes sense.
“Reasonable safeguards should be explainable to reasonable people.”
4. Continuous Engagement
Governance is not a one time effort.
It evolves with usage.
The Real Measure of Success
It is not zero risk.
That is unrealistic.
It is when employees start asking:
- “Is this safe to use?”
- “Do I need approval?”
- “What is the right way to do this?”
“The moment people start asking those questions… that is success.”
Turning Shadow AI Into a Competitive Advantage
Here is the shift organizations need to make:
| Old Thinking | New Thinking |
| Shadow AI is a threat | Shadow AI is a signal |
| Block usage | Guide usage |
| Control employees | Empower employees |
| Enforce policies | Build trust |
Because when done right:
Shadow AI becomes:
- A source of innovation
- A driver of productivity
- A competitive differentiator
A Final Thought
“AI in the shadows is not the problem. Lack of visibility is.”
The organizations that win in this new era will not be the ones that control AI the most.
They will be the ones that:
- Understand how it is being used
- Create safe pathways for adoption
- Build trust across teams
Shadow AI is already shaping your workplace.
The question is:
Will you chase it… or will you lead it?
Meet the Speakers
This discussion brought together leaders across cybersecurity, privacy, and enterprise IT, each offering a unique perspective on how organizations can approach Shadow AI today.
- Elie Nasrallah
With nearly three decades in cybersecurity, Elie brings deep expertise in helping organizations navigate emerging threats. His work focuses on AI security, data protection, and real time visibility into modern risks.
- Cornelius Temple
A seasoned leader with over 30 years of experience across technology and business, Cornelius leads Microserve’s client facing teams and drives strategic conversations around security, AI, and digital transformation.
- Christopher Ross
Christopher leads a unified approach to cybersecurity and privacy at the University of Northern British Columbia. His work focuses on governance, compliance, and building practical frameworks that balance innovation with protection.
Ready to Take Control of Shadow AI?
Shadow AI is already happening across your organization. The difference between risk and opportunity comes down to visibility, governance, and the right strategy.
At Microserve, we help you uncover hidden AI usage, protect sensitive data, and build practical guardrails that empower your teams without slowing them down.
Whether you are just starting your AI journey or trying to regain control, we will help you move from uncertainty to clarity.
Start with a conversation.
Let’s assess where you are today and build a clear path forward.
👉Get in touch with our security experts today and take the first step toward secure, trusted AI adoption.
