NCSC Warns Shadow AI Creates New Security Risks
UK NCSC warns that unapproved AI tools used by 71% of UK employees expose corporate data and create hard-to-detect organizational security risks.
The UK's National Cyber Security Centre warned on 7 September that shadow AI, unapproved AI tools used outside organizational controls, creates visibility gaps and raises risks of data breaches, intellectual property loss, and regulatory non-compliance. It cited Microsoft research finding 71% of UK employees had used AI tools not approved by their employer. NCSC also warned AI agents can carry critical vulnerabilities, allowing attackers who exploit one to inherit the agent's data access, services and privileges, and that attackers are highly likely to abuse agents with looser guardrails. The agency recommended reducing rather than eliminating shadow AI through positive security culture and clear guardrails.
- Microsoft research cited: 71% of UK employees use unapproved AI tools.
- Risks include data breaches, IP loss, regulatory non-compliance, and reduced visibility into data flows.
- Vulnerable AI agents could let attackers inherit agent privileges and pivot into corporate IT.
- NCSC recommends reducing, not eliminating, shadow AI with open dialogue and clear secure-use guardrails.
- Vendors
- Microsoft
- Organizations
- UK National Cyber Security CentreNCSC
- Countries
- United Kingdom
From the original article
2 min read at infosecurity-magazine.com
NCSC warns unapproved AI tools can expose corporate data and create new security risks
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.