Microsoft's latest 2025 Work Trend Index found that 78% of employees using AI at work are actually using tools they brought in themselves, not ones that were approved by IT. Even Cisco's AI Readiness Index found that 48% of employees have entered non-public company information into an AI tool. This isn't a fringe habit anymore. It's most likely already happening somewhere in your office, on Long Island, or anywhere else.
Why This Happens
Samsung found out the hard way in 2023. Engineers there were using ChatGPT to help debug code, and at some point started pasting actual proprietary source code into it to speed things up. That code went straight into a public tool with no data-retention protections, sitting outside the company's control the moment it was submitted. Security teams still bring this case up constantly. Not because it was some elaborate attack, but because nothing malicious happened at all. An employee just wanted to finish a task faster, and that alone was enough to leak internal IP.
Recent data from IBM and PagerDuty's Shadow AI Survey found that shadow AI incidents accounted for 43% of all AI-related security incidents in 2026, more than double the 20% recorded the year before. The average AI-related breach now costs organizations roughly $6 million, about $1 million more than the average cost of all data breaches combined.
On Long Island and across the New York metro, the pattern looks the same in a law office in Garden City as it does in a manufacturing shop near the Hauppauge Industrial Park. The categories of exposure tend to repeat across companies:
- Financial figures uploaded to a public tool to reformat a report or presentation
- Client records containing personal information pasted into a translator or writing assistant
- Proprietary source code shared with a public model to debug faster
None of this trips a firewall alert. It looks like ordinary HTTPS traffic, which is exactly why standard network monitoring misses it, a pattern that connects to the broader shift we covered in why AI-powered cyberattacks are increasingly aimed at businesses on Long Island.
Sanctioned AI vs. Public AI
| Category | Company-Approved AI | Public AI |
|---|---|---|
| Data Handling | Zero-retention agreements; inputs aren't used to train the model. | Stored by default; may be logged or used for future training. |
| Visibility | Logged through IT's own consoles. | Invisible, tied to a personal account. |
| Compliance | Built to meet HIPAA, SOC 2, and similar standards. | Puts you at immediate risk of violating them. |
| Access | Tied to Active Directory and role-based permissions. | Open to whoever has a personal email. |
What's the Solution?
A workable enterprise AI governance framework does three things instead:
Say What's Off-Limits, in Plain Language
Skip the legal boilerplate. Tell people directly: financial figures, client data, and source code don't go into a public AI tool, period. Then tell them which tools are fine to use.
Watch Where the Browser Is, Not Just the Network
Most of this activity happens through personal accounts inside an ordinary browser tab, so network-level monitoring alone won't see it. Endpoint tools that watch activity at the browser level can catch a risky paste before it ever leaves the device. This kind of layered, agent-aware monitoring connects to a broader shift in how AI tools talk to company systems, which we broke down in our guide to MCP and how it powers AI agents.
Give People a Safe and Verified Version of the Tools They Already Use
What This Costs You If You Wait
Shadow AI doesn't announce itself. There's no breach alert, no locked screen, and nothing that looks like an incident. The exposure just sits there quietly until a client's data resurfaces somewhere it shouldn't, or an auditor asks a question nobody can answer.
Between the compliance requirements piling up in the New York market and the sheer number of employees already doing this without asking, ignoring it isn't really an option anymore.
FAQs
Is using ChatGPT at work automatically a security risk?
Not always. Enterprise versions with zero-retention agreements are built for business data. The risk comes from free, consumer-grade tools where inputs may be stored or used to train future versions.
How would I even know if my employees are doing this?
Standard firewall and network monitoring usually won't show it, since it looks like normal browser traffic. Browser-level and endpoint monitoring tools are built specifically to catch this kind of activity.
Do we need to ban AI tools completely to stay safe?
No. A ban without an alternative usually just pushes the behavior further out of sight. Pairing clear rules with an approved, secure AI option tends to work better.
What's the first step toward getting this under control?
Most companies start with a look at what's actually happening on their network today. From there, you can build a policy and put the right monitoring in place.
Ready to see where your own exposure sits? Get a quote from B&L PC Solutions and we'll walk through what an AI governance review would look like for your team.
Tags: Active Directory access control, cyber security companies NYC, Cyber Security Solutions NYC, enterprise AI governance framework, generative AI data leakage, internal data privacy compliance, Managed IT Services Long Island, public LLM security risks, unauthorized artificial intelligence tools, unsanctioned software policies
