Shadow AI raises concerns among cybersecurity professionals

But security pros may be among the most active shadow AI users within their organisations

“Shadow AI isn’t a future risk. It’s happening now,” says Mindgard co-founder and CEO Peter Garraghan.

The unmonitored use of AI tools is a growing concern, according to over 500 cybersecurity professionals recently surveyed at the RSA Conference 2025 in San Francisco and InfoSec Europe 2025 in London.

The survey, conducted by Mindgard, also revealed that nearly 25% of cybersecurity professionals said that they use AI tools like ChatGPT or GitHub Copilot within their organisations without any formal oversight.

A recent report from Gartner also warned about the potential risks associated with shadow AI.

“CISOs must define a robust programme of education, monitoring and filtering to encourage innovation while mitigating shadow AI risks,” Gartner said in a summary of its report.

Shadow AI use can introduce risks to sensitive data with the potential of AI tools accessing that data.

Mindgard’s report offered other revelations about shadow AI in the enterprise:

• 56% of security professionals said employees use AI without formal approval
• 87% said they themselves are using AI in their daily work
• Only 32% said their organisations have formal AI controls in place
• 39% said no one in their organisation owns AI risk
• 12% said they had no visibility into what is being entered into AI systems within their organisation
• 20% said they have used AI with their organisation’s regulated or sensitive data

“AI is already embedded in enterprise workflows, including within cybersecurity, and it's accelerating faster than most organisations can govern it,” Garraghan said in a statement. “Shadow AI isn’t a future risk. It’s happening now, often without leadership awareness, policy controls or accountability.

"Gaining visibility is a critical first step, but it’s not enough. Organisations need clear ownership, enforced policies and coordinated governance across security, legal, compliance and executive teams. Establishing a dedicated AI governance function is not a nice-to-have. It is a requirement for safely scaling AI and realising its full potential.”

Access Mindgard’s full report here.

This article originally appeared on Computing ’s sister site, MES Computing.