tag: Shadow-It · 4 items
- Engineer — Skip
- SOC/IR — Skip
- Leader — Learn: Illustrates the growing governance gap as employees ship AI agents and automations outside formal review; useful framing for a CISO building an AI-use policy, but no specific incident or deadline triggers a concrete action now.
- Engineer — Skip
- SOC/IR — Skip
- Leader — Plan: Shadow AI use is a real data-leakage risk worth a policy response; this quarter, review whether your DLP controls cover personal AI tool usage and confirm your acceptable-use policy explicitly addresses unapproved AI services.
- Engineer — Learn: Personal AI agents inheriting employee OAuth tokens and authenticated sessions represent a new identity attack surface; worth auditing OAuth scope grants and evaluating zero-trust controls that distinguish human vs. agent principals, but no patch or immediate reconfiguration is required today.
- SOC/IR — Plan: Begin developing detection logic for AI agent behavioral patterns — high-frequency API calls, non-browser user agents, bulk data access at odd hours — to establish baselines before this becomes a blind spot in existing endpoint and SIEM coverage.
- Leader — Plan: BYOA is an emerging shadow-IT risk category analogous to early BYOD: employees are already granting personal AI services access to corporate data without a policy framework; add AI agent acceptable-use and data classification policies to the next governance review cycle.
- Engineer — Plan: Underground AI proxy services capturing user prompts represent a shadow-IT risk if employees seek cheaper LLM access; audit API usage logs for unauthorized AI service traffic and enforce an approved-services allow-list.
- SOC/IR — Learn: Emerging TTP: threat actors operate MITM-style LLM proxy services to harvest organizational prompts at scale; no IOCs provided, but this informs future DLP and proxy-monitoring detection design for AI service abuse.
- Leader — Plan: If employees use discounted underground AI services, proprietary business data in their prompts flows directly to threat actors; review and communicate AI acceptable-use policy and evaluate DLP controls for prompt exfiltration this quarter.