AI can make everyday work easier. Drafting an email, summarising a document or finding a clearer way to explain something are all sensible reasons to use it.
The question for businesses is how to give people those benefits while protecting company information and keeping devices secure.
That starts with understanding what people are already using, giving them suitable tools, and making sure they know where to turn when something doesn’t look right.
What is shadow AI?
Shadow AI means people using AI for work without the business knowing about it or approving it.
It could be someone using a personal ChatGPT account to rewrite a customer email, uploading a customer contract to a free analysis website, or trying an AI meeting tool without checking what happens to the recording.
The intention is entirely positive – save time and be more accurate.
A useful starting point is to ask your team which tools they use and what they find helpful. This is an opportunity to understand their needs, rather than a reason to discourage them from exploring AI.
It also helps answer an important question: if someone reaches their free usage limit, do they know which alternative the business is happy for them to use?
Is free AI unsafe?
Not necessarily. The price alone doesn’t tell you whether a tool is suitable for business information.
What matters is the service, the account being used, its privacy settings and the terms covering your information.
For example, OpenAI says content from personal ChatGPT accounts, including paid personal plans, may be used to improve its models unless the user opts out and ChatGPT Business and Enterprise have no training on business inputs and outputs by default.
There is also a difference between asking for general ideas and uploading a contract containing customer names, pricing and confidential terms.
Our recommendation is to give staff:
- A short list of approved AI tools.
- Clear examples of information they can and cannot share.
- A contact for questions or requests to use another tool.
“Don’t upload customer contracts to unapproved AI websites” is easier to follow than “be careful with sensitive information”.
What if the risk goes beyond sharing information?
A recently documented attack shows why AI awareness needs to cover more than privacy.
Researchers at Huntress found attackers abusing Custom GPTs, customised chatbots created by third parties and hosted on the genuine ChatGPT website. These malicious versions displayed fake availability notices and directed users to a supposed backup website.
It’s important to clarify, this was not ChatGPT itself being compromised. Attackers were using third-party content on a familiar platform to make their instructions appear trustworthy.
For someone trying to finish a task, a link offering to restore access could look helpful. That is what makes the example worth discussing with staff.
What happened after someone followed the link?
The link opened a fake verification page. Users were instructed to run a computer command, supposedly to prove they were human.
Following those instructions downloaded malicious software. The attack ultimately installed a remote access trojan, a malicious program that gives an attacker a way to access and control a computer.
The practical advice is straightforward:
If an AI tool or website unexpectedly asks you to install software or paste a command into your computer, stop and check with your IT support provider.
If someone has already followed the instructions, encourage them to report it promptly. The priority is getting help, not assigning blame.
How can businesses make AI use safer?
At HJS Technology, our recommendation is to combine three layers: approved AI tools, regular awareness training, and 24/7 detection and response.
Each addresses a different part of the problem.
Provide a suitable business AI tool
Giving staff an approved option removes some of the uncertainty about which service and account they should use.
- For businesses using Microsoft 365, Copilot is an option to assess. When used with the appropriate work account, Copilot and Copilot Chat provide enterprise data protection. Your organisation’s Microsoft 365 environment is sometimes called its tenant, its own managed space within Microsoft’s cloud, and Microsoft states that prompts, meaning the questions and information entered, and responses are not used to train models and data stays within your own tenant.
For most businesses, the practical takeaway is simple:
Choose a business service with appropriate protections, configure it properly, and explain what information staff are permitted to use with it.
Also give people a route for requesting help when they reach a limit or need a feature their approved tool does not provide.
Help people use it with confidence. Giving people access to Copilot is only half the job. If they don’t know how to get good results, they’re more likely to go back to whatever free tool they used before.
That’s why we offer the Zensai Adoption Hub. It’s ready-made Copilot and Microsoft 365 training that sits inside Teams, Outlook, SharePoint and Copilot, so staff learn in the apps they already use. There’s no new portal and no extra login. People sign in with their existing Microsoft 365 account.
Keep staff informed through regular training
Cyber awareness training should help people recognise situations they might encounter during an ordinary working day.
- The aim is not to turn everyone into an IT specialist. It is to give people enough confidence to recognise when something needs checking.
Back this up with 24/7 detection and response
Even with suitable tools and good training, businesses should plan for something getting through.
- Managed Detection and Response, or MDR, combines security monitoring with specialists who investigate and respond to suspicious activity. HJS Technology’s managed security services include round-the-clock monitoring and threat detection and response.
For an attack involving malicious software, the purpose is to identify suspicious activity and take action to contain the threat. Our MDR offering includes monitoring for attacker behaviour and isolating compromised devices.
The goal is to reduce the opportunity for an incident to develop, and have people ready to respond when it does.
Where should your business start?
You do not need to solve everything at once.
Start with a conversation about which AI tools people use. Agree an approved option, explain the boundaries for business information, and include cyber security awareness training so that your staff are well prepared.
Then review the protection behind your team: if someone follows a convincing but malicious instruction, who is watching for the consequences, and who will respond?
Next, provide them with access to some help. The Zensai Adoption Hub is a great way to empower your team with bite-size training so that they can get the most out of AI.
Safer AI use is about supporting people, not expecting them to spot every threat on their own.
HJS Technology can help your business bring those layers together: suitable business AI, practical training and 24/7 managed detection and response.