Detecting Shadow AI, Measuring AI Adoption, and the Hidden Cost of Blocking AI: Insights from The AI Blind Spot Webinar

Absolutely. Thanks, Julia. I think the conversation has definitely evolved past “should we adopt AI” to “how do we adopt AI.” I have the pleasure of speaking to many security leaders across different organizations, and the

theme that keeps coming up is that AI is not a software problem. It’s a business continuity problem, it’s an operations problem. We know that two thirds of employees are already using some sort of AI at work, but only one in five orgs actually have some sort of formal policy in place today.

And only a quarter of them have real visibility. When it comes to visibility, you have different workflows across different departments. Your dev team is probably using tools like Claude Code. Marketing is probably using ChatGPT or Gemini. Legal is probably leaning on Perplexity.

So this creates two separate strategies for a lot of organizations: one on paper that you’ve written in your boardroom, and one your employees are working out on their own. And most security leaders only see the one they’ve written, not the second.

Yeah, I think the instinct to deploy the tool that’s easiest to deploy is probably what comes to mind for most leaders. But when I’m talking to leaders, I think a discovery phase is very important. We know that two thirds of employees are using AI, so why not understand the workflows

across the various departments? Do the discovery phase: watch what they’re doing, how they’re doing it, why they’re doing it. Each tool has its purpose. Like I said, dev teams are using Claude Code, sales is probably using ChatGPT.

So the tools you may assume everyone was going to use probably don’t show up as often at all, and

this allows you to make decisions on purchasing different AI licenses based on behavior, not assumption.

It also lets you see what normal looks like in your organization, and it’s a much easier conversation to have with your CFO when you want to make a large AI deployment. You’ll see which departments need to use these tools.

Maybe Claude is a token-heavy tool, and your support staff only need a simple LLM where they can ask questions. So there are various use cases across the organization.

Yeah, you both made some great points, Nabil especially on the different industries. I think there are so many AI tools out there today that most companies think they have AI covered because, oh, I bought licenses for

Claude or ChatGPT, that’s what I’ve rolled out in my environment, and that’s what I’m expecting my end users to be using.

They roll that out and just don’t fully understand the adoption and the usage.

Taking BrowseReporter here, when you’re looking at the whole scope of the picture, you can see what’s in use, see the license usage, see how much users are adopting it. Is it just heavy usage? Are they using it on a day-to-day basis?

Are they using the app versus the website? Being able to understand which AI sites your internal people are working on, and how often, takes the guesswork out of it and turns it into a baseline, so you can see, from your

governance and security framework, where there might be some gaps you need to plug.

Yeah, absolutely. We know the model tech companies like to use: move fast, break things. With that in mind, tech companies are more keen on letting their teams deploy different AI tools, as long as productivity increases and they get a lot more done.

But security leaders in these companies still want to make sure shadow AI is not being deployed and people are not using these tools for malicious reasons. Healthcare firms, on the other hand, tend to be more conservative. They have strict privacy obligations and follow HIPAA for compliance, so

they want to make sure no PHI is getting uploaded to the wrong LLM. They’re a little more hesitant to deploy tools on a grand scale. But research this year flagged that healthcare is having some of the most acute shadow AI

exposures of any sector. So each vertical is fighting its own battle. Based on the conversations I’m having, it’s a really diverse frame of thought.

Yeah, great questions, Julia. Let me pull up CurrentWare Cloud. One other call-out: we do have question-and-answer time at the end, so feel free to put your questions into the Zoom Q&A option. If you ask anonymously, your name won’t be shared if we answer it.

If you don’t, your name may pop up. Just as a heads-up.

Let me pull up the console here,

and I’ll give you a quick rundown of what our new AI visibility tool looks like. That’s the AI Insights dashboard, here within BrowseReporter.

It comes down to a simple question: where is AI showing up in my org, and who’s using what? The first thing you can see in this dashboard is which AI platforms are being used.

A lot of people are surprised by how long this list can get. It’s not just, hey, I’ve only got these. It’ll pick up all of the other tools users are potentially using within your org. We’ve got the most common ones in here by default.

You can add new websites or applications for any tool you want to track, if there are more custom tools within your org.

Then you can break it down by the number of users who have adopted it and the average usage. We can even pull in utilization based on productivity:

how often, and how productively, users are working with these tools. You get the full user-by-user breakdown by app. You can see here with Cursor, we’ve got 20 hours in the app

and 31 seconds on the website. Similarly with these other tools, we can see usage, and you can tag them as authorized or unauthorized apps. Authorized means it’s something you’re expecting to see within the org. You’re expecting the usage there; it’s allowed.

Versus some of these other tools: we’ve got Perplexity, we’ve got Gemini, we’ve got Grok. You can add any number of them, and that’s where you can flag them as unauthorized. So when you come in here, you can very easily see which tools are in use and which tools shouldn’t be.

Then you have a couple of other trend views. You can see AI trends over time to check whether the tools you’ve implemented are seeing a lot of use. Is your users’ AI usage going up day to day? Is there a day, like Mondays, where users use a lot of AI tools, while on Fridays we’re not seeing much AI usage at all?

And then you can understand adoption as a whole.

On the 29th, we’ve got one casual user, and seven other users didn’t use AI tools at all.

That could be a concern: maybe the tools we’re rolling out aren’t the right tools for the workflow. Or it could just be reluctance to start using them, even though users can probably be trained on how these tools will make their workflows more efficient

and make their work easier.

And that’s where you can spot any of these tools, maybe even an unknown one, where you start at zero and suddenly see 50 users all using one tool. Oh, we were using Copilot, but I can see 50 users are trying to use Claude or ChatGPT. Maybe they’re more comfortable with that, and that’s what our tool of choice should be as well.

Yes, 100%. Thank you, Julia. I think we’re in uncharted waters with the way things are being done. Everyone is

taking a bit of a step back, I find. They’re waiting to see who’s willing to take the plunge and start implementing policies, and whether those policies turn out to be successes or failures,

so they can learn from how others approached it, from the failures and the successes, before they take the step of implementing their own. What I’m seeing with our clients really comes down to two different avenues.

First, clients taking the more cautious approach of not really implementing any policies as such, but because CurrentWare tracks what employees are doing,

they’re able to monitor how employees are using AI and whether they’re benefiting from it,

and then taking that information to slowly build out a more robust policy they can implement at a later stage, based on what they’ve learned.

And then secondly,

a lot of our clients are taking a firmer stance: implementing a policy and saying, this is the way things are done. They create allow and block lists: this is what employees have access to, this is what they don’t, and this is the rule of law.

Or, on the flip side, implementing a policy where

employees are allowed access to any AI they want to use in the workplace, but over time,

the organization sees how employees are using that AI and builds out a policy to put in place at a later stage, depending on its findings.

Yeah, I think it’s a bit of a catch-22. Every department within an organization is going to use AI in a very different way: the HR team versus finance, accounting,

IT, and so on. Everyone will benefit from and use AI differently. So taking a one-lane approach can stop people in their tracks and keep them from doing their work efficiently. AI is there

to assist you at the end of the day. You could run into a bottleneck by being too strict with these policies too early on and inhibit employees from doing their work. So I think taking the more cautious approach, at least from what I’m seeing, and identifying how your different teams use AI

makes that policy so much stronger at the end of the day.

Yeah, and that’s a really important governance principle I’ve found. You can write a policy that says nobody may use these tools, but employees still have deliverables.

And if an employee believes there’s a tool out there that can help them do their job more efficiently, they will find another way to access it. And now you’ve potentially moved that activity somewhere you have even less visibility.

Yeah, so the big thing right now is making sure employee data, customer data, everyone’s data is protected. The moment you put something on the internet, it’s accessible to everyone else.

On one side, implementing very strict policies, where you give employees access to specific tools and nothing else,

doesn’t stop anyone from putting a personal device right next to their machine, moving data from one to the other, and still using that information. Then you’re completely blind as an organization to what your employees are doing. Having policies in place where

employees can still potentially use AI, but you can see exactly how they’re using it, is different. If I have a policy where employees are allowed to use AI tools X and Y but not Z,

I can still access the tool I’m not supposed to be using, but CurrentWare gives the organization that information when it happens. Then that information can be taken to the employee to steer them in a better direction, versus them gaining access

[by other means.

Yeah, I think the way I would describe it, especially when it comes to making

decisions that lead to positive outcomes: if I’m busy cooking dinner, for instance, and I give my daughters a couple of paintbrushes and some paint

and say, keep yourselves busy, and I walk away, within five minutes there’s probably going to be paint on the floors, the walls, and the couch. Giving them a piece of paper and a little bit of direction, saying, hey,

here’s a piece of paper, please make sure you only paint on what I give you, is good direction. But if I walk away,

again, within five minutes of them following my instructions, there’s going to be paint on the walls, the floors, the ceiling, for all I know. Giving them the tools to do the work,

plus direction on what they’re supposed to be working on, is good, but they still need monitoring and direction so they don’t stray from what I want them to do. If I’m there and I can tell them, great, I can see you’re starting to

bleed over onto the table, get back onto the page, then it’s easier to manage what they should and shouldn’t be doing. And that translates directly into how I want to set up my policy, so that my employees are accessing and using AI in a way that

doesn’t lead to paint on the walls and floor, essentially.

Yes, got it. I’ll pull up my screen again, show you CurrentWare Cloud, and go through the workflow here.

So looking back into the console, we’re back in AI Insights, where you can easily see the unapproved, unauthorized applications we’re talking about.

If you’ve got a massive list of applications your users are using, it’s kind of the Wild West out there.

New tools are popping up every day, and you’ll be able to pull all that information. You can also see the actual usage down here in the activity log.

Then, to tie it together, within BrowseControl

you have a couple of different options. You can use a basic URL filter and add a block list of just the specific tools, the web pages, you want to block.

It’s completely up to you and completely granular, as deep into the page as you want to go. Or if you want to just block the websites and allow the apps,

you have the option to do individual web page blocks.

You can also block AI completely, so any AI page gets blocked. Alternatively, you can put specific pages on the allow list while the AI category is blocked. That means the specific pages you want to allow

will bypass that category block of AI tools.

And you also have the ability to block by application. So you could grab chatgpt.exe, claude.exe, or cursor.exe,

and just apply that. The advantage here is you can do it group by group: your front-end users, potentially, who you don’t want using these tools, or specific developers who can only use

specific tools that you have governance over,

[versus just allowing it widespread. You can do everything group by group, or across the entire org. It’s completely up to you how granular you want to get with your blocks.

Yeah, I think it goes back to the theme of visibility: understanding workflows and making sure

you’re not treating AI as a one-size-fits-all solution. It’s easy to deploy a tool everyone’s heard of and think it’s going to get used evenly across the org. But having that discovery, understanding why people need certain tools, and then making the decision

from there might actually be a cost-saving practice for you as well. If you deploy 1,000 licenses across the board, they might not get used. You might only get 30 to 40% adoption. But if you get specific based on department and the different

tools individuals need for their role, you might get better ROI overall.

The goal for AI is obviously to increase productivity for the firm. So as long as you invest in the right tools, you’ll get better ROI at the end of it.

Yeah, we’ve already got a couple of questions in there, so I’ll field some of these as we go. I was trying to get to them while paying attention at the same time.

The first question we had: what percentage of companies we work with seem to have a governance plan in place, and how does CurrentWare directly impact governance decisions?

First off, great question. I don’t have an exact number, but based on the calls I handle, I’d say roughly one in five even mention AI, and even then it’s probably just “we’ve got an AI policy.” Somebody wrote it, people signed off on it, and nobody has looked at it since.

It’s such a hot topic, trying to figure out usage. Most of them have that one tool in place, but the AI space is the Wild West right now. New tools are popping up every day, and existing tools are gaining new capabilities every day.

So what CurrentWare can help with, when we’re talking about a governance plan, is visibility: BrowseReporter to see application and website usage,

and then BrowseControl to lock it down and restrict the use of unapproved tools.

We don’t write a governance plan for you. We give you the guidance and the visibility to write a realistic governance plan and policies, to take action and control usage, and to stick to the controls you’re putting in place.

Thanks, Mike. That basically covers everything. I’ll add one thing: if you’re developing a governance plan and you want to better understand what visibility is available to you, what tools are available, and how they

work with your environment, you’re always welcome to reach out to our success team and your customer success manager. It’s quite literally part of our job to make sure clients understand the tools they have, whether that’s attending webinars like this or reviewing the newer resources we develop.

I know we’re working on an AI governance page for our website, but if you want a second pair of eyes on your data as you develop a plan, we’re available. We’re happy to help, and it’s exciting for us to learn more about the challenges our clients are facing.

Continuing down the question list, we’ve got another one: how can you tell the difference between high usage and healthy adoption?

I’ll half-field this, and maybe Nabil or Herman can hop in, but I’d say high usage on its own doesn’t tell you a whole lot.

You’re looking for consistency and spread. Are people coming back to their tools? Is it something they burst-use for one project and then never use again day to day to streamline their workflows?

Is it just one team, or a single power user on that team? Is it an approved tool, or something on the side? Healthy adoption really looks like steady, repeat use of the tools you’ve approved,

across the entire team and across the parts of the org you’d expect.

And then for the business side, I’ll hand it off to Nabil to give a bit more insight.

Yeah, absolutely. I think healthy adoption is about being able to scale.

If you have a power user who’s getting great ROI from a specific tool,

with a solution like CurrentWare you can mirror and replicate those workflows for other users in your organization, and really help level up everyone else who’s

probably struggling, or using a different tool to

work on those same tasks. Enabling the whole organization to use these tools properly is also worth highlighting here.

I can jump in with one thing I find interesting: how I’ve seen some clients

read the data.

Take ChatGPT as an example. If I’ve tracked that my employees used ChatGPT for, let’s say, seven or eight hours over a one-week period, there’s a very big difference,

because you can see what they’re doing and what kind of prompts they’re entering into ChatGPT, between whether they’re

searching for recipes

or using ChatGPT to generate quotes, or entering user data into ChatGPT. So being able to identify exactly what employees are doing while they use these tools is a really important part of putting these policies in place.

Exactly.

Oh, no, sorry. I was marking on our back end that we were answering that one live. Sorry about that.

I can try to go at that. I think at the core, we are a user behavior analytics platform. We’re looking at

your users’ behavior across the organization in many different facets. AI is one aspect of it, but we also want to make sure users

have healthy hygiene on their endpoints and aren’t uploading sensitive data to LLMs or even emailing it out. Productivity is another aspect of our solution, making sure users are giving their time back. So in a nutshell, we’re a user behavior analytics platform that gives

organizations a bird’s-eye view of what’s happening across the board.

And the three buckets we specialize in are AI governance, user activity, and data loss prevention.

That was a little longer than one or two lines, so I’m going to try to shorten it a bit. If it were one or two lines: we give you visibility into how your team actually uses AI on the web and in applications, and the ability to control and act on it.

So think of us as sitting before the policy: we let you see what’s happening first, then decide what to allow.

And we help you enforce your AI governance policy. I think that’s a big one. You write the policy; we help you enforce it.

Let me noodle on that one for just a second.

I’d say the first thing to do if you think you have a shadow AI problem is get visibility. You need to look into what’s happening. It’s not a matter of blocking anything. It’s a matter of aggregating the data you

already have on what’s actually being used, and nine times out of ten, I guarantee you the list will be longer than you expect. That alone will tell you where your policy conversation needs to start, and what you need to start

from: what’s allowed to be used, and what do we want to start blocking? That starts to build the core of the policy you and your team need to put in place within the org.

Yeah, I agree.

I think an investigation is also a key part of that process, to make sure that

if it’s something malicious and someone is acting with ill intent, you start monitoring that individual and looking at exactly what that shadow AI is being used for, and what they’re doing with it.

That was just a great point made in the chat there, and it’s what we’re echoing. It’s fantastic to hear, even within this webinar, that people are working through this and understand

the value of hammering out the workflow that works best for them and understanding the end user. You don’t really want to restrict an end user too much, but

you want the evidence to be able to manage teams and explain why you’d want to do it that way.

Again, we don’t want paint all over the walls, the couch, and the floors.

Keep everyone in line.

It’s funny you mention that, because it comes back to that point:

assuming your employees are going to follow the rules isn’t good enough.

You’re essentially the resident daycare supervisor, making sure everyone is following the rules, but they need guidance at the end of the day. If they don’t have any guidance,

they can do whatever they want.

Thanks, Julia. Thanks, everyone. Bye.

[Thanks, everyone.