The overwhelming majority of enterprises — together with small and medium‑sized companies — have included AI companies into their workflows. Based on an October 2025 survey by the Small Enterprise & Entrepreneurship Council, simply 12 p.c report not utilizing AI instruments, whereas most make use of a mixture of purposes throughout analysis, advertising, customer support, finance and stock administration.
Because of this, we’re witnessing the rising problem of Shadow AI, by which staff use publicly obtainable AI companies with out approval from their IT division. This creates uncontrolled knowledge flows and raises the danger of confidential info publicity. The problem could be particularly related for medium‑ and small‑sized firms that sometimes lack a devoted IT funds for AI service deployment.
So, what are the principle threats SMBs might face due to Shadow AI, and the way can they mitigate these dangers?
Dwelling within the shadows
Some staff discover it extra handy to make use of software program that has not been authorised by their IT division, and so they may effectively advocate that very same software program to colleagues. Because of this, half the workplace workers use unapproved messengers or add recordsdata to probably unsafe cloud storage companies. This phenomenon known as Shadow IT. Right this moment, with the rising recognition of AI instruments in enterprise workflows, an identical Shadow AI phenomenon is gaining momentum.
Among the many most important challenges for company cybersecurity is the truth that menace actors are more and more embracing the AI hype and exploit it for their very own profit. Particularly, they actively distribute cyberthreats masquerading as common AI companies. In the meantime, staff who’re unaware of the potential dangers obtain apps from untrustworthy websites and click on on suspicious hyperlinks.
Between January and April 2026, Kaspersky options detected greater than 33,300 assaults on small and medium-sized companies, by which malicious or undesirable software program for PCs was disguised as common AI companies. This determine is sort of 5 occasions greater than the identical interval in 2025. At first of 2026 the most typical lures in cyberattacks concerned malware posing as ChatGPT (42%), Claude (24%) and DeepSeek (20%).
What’s extra, new AI companies seem on daily basis, making it tough for workers to differentiate a brand new, unfamiliar service from a pretend one. Cybercriminals additionally exploit this; for instance, not too long ago our consultants recognized a rip-off web site providing an AI service “constructed for contractors.” In actuality, victims obtain nothing after paying for a subscription, whereas the scammers preserve all the cash.
Sharing just isn’t caring
The opposite situation associated to the Shadow AI phenomenon considerations the sharing of confidential company info with third-party AI chatbots, even reputable ones. Inconsiderate actions by staff can result in knowledge breach incidents. Sadly, such incidents have already occurred — they might stem from cyberattacks or from vulnerabilities and flaws launched throughout AI companies’ improvement course of. For instance, a while in the past it was found {that a} flaw in ChatGPT allowed some customers to view components of messages from others. It can’t be dominated out that a few of these communications contained company knowledge.
It’s additionally essential to keep in mind that any info a person shares with AI chatbots is saved on the builders’ servers and could also be utilized in accordance with that supplier’s phrases and insurance policies. Builders of enormous language mannequin chatbots might use offered knowledge for varied functions, equivalent to coaching newer variations of their fashions. Particulars about how knowledge is saved and processed are outlined within the Phrases of Service, and we strongly advise reviewing these paperwork earlier than utilizing any AI device.
One other downside is that credentials (login-password pairs) for varied AI companies – chatbots, picture modifying, translation, voice mills, and many others. – are being compromised because the companies achieve recognition. Cybercriminals sometimes purchase and promote such accounts on darkish‑internet marketplaces. These accounts are sometimes initially stolen with knowledge‑stealing malware after which leaked through infostealer log recordsdata, the place they are often additional monetized as helpful belongings within the cybercrime ecosystem.
If attackers achieve entry to an worker’s AI service account, they will retrieve the confidential info that the worker uploaded there. Furthermore, they may doubtlessly develop a cyberattack plan towards the corporate utilizing the compromised knowledge.
Leaving the shadows: Cybersecurity suggestions for SMBs
Normally, AI platforms utilized in a company ecosystem ought to meet excessive reliability and safety necessities. Safety must be complete: from securing the AI infrastructure to defending towards giant language mannequin‑particular assaults (equivalent to oblique immediate injection) and from switching from publicly obtainable cloud companies to on‑premise deployments of LLMs. Nonetheless, it’s comprehensible that, for small and medium-sized companies, many of those measures could also be impractical, and Shadow AI is tough to handle as a result of many SMBs typically lack enough monetary and human sources.
Subsequently, to attenuate cybersecurity dangers, SMBs can comply with sure cybersecurity finest practices:
- Set up clear utilization insurance policies for exterior companies, together with AI platforms. Outline procedures for coordinating duties equivalent to new‑software program implementation with the IT division, system directors and different accountable managers.
- Elevate safety consciousness amongst staff. Present devoted coaching that train workers methods to detect and handle potential cybersecurity threats (malware assaults, phishing, rip-off, and many others.), and monitor their instructional progress.
- Keep away from downloading purposes from unofficial sources; confirm that apps are suitable with the working system that’s used on a company system.
- Educate staff fundamental secure‑AI practices. Use robust, distinctive passwords for AI‑service accounts and alter them often to scale back the influence of credential theft. Don’t share confidential company knowledge with chatbots, because it might grow to be public as a consequence of potential knowledge breaches. In any case, earlier than utilizing any AI service, overview its Phrases of Service to grasp how your knowledge is saved and processed.
- Implement price‑efficient cybersecurity options that suit your funds, measurement and trade necessities, emphasizing scalability and straightforward integration. Such options can detect threats promptly and assist mitigate dangers, together with these stemming from human elements.
Vasily Kolesnikov is Safety Professional at Kaspersky.
TNGlobal INSIDER publishes contributions related to entrepreneurship and innovation. Chances are you’ll submit your individual authentic or printed contributions topic to editorial discretion.
The brand new actuality of enterprise safety: Scaling resilience amid complexity