An artificial intelligence chatbot could help quickly clean up your presentation moments before an important board meeting. But those quick AI fixes can become a liability for the higher-ups you\u2019re trying to impress.<\/p>\n
More employees are using AI tools to help them complete work tasks and increase their productivity, but most of the time, those tools aren\u2019t approved by companies. When employees make use of unauthorized AI platforms and tools, it\u2019s referred to as shadow AI, and it creates a risk that workers could accidentally disclose sensitive internal data on these platforms, making the company susceptible to cyberattacks or intellectual property theft. <\/p>\n
Often, companies are slow in adopting the latest technology, which may push employees to seek third-party solutions, such as AI assistants, said Kareem Sadek, a partner in the consulting practice at KPMG in Canada specializing in tech risk.<\/p>\n
This so-called shadow AI often seeps in when users are looking for convenience, speed and intuitiveness, Sadek said.<\/p>\n
But these unauthorized tools are becoming a headache for Canadian businesses, big and small.<\/p>\n
\u201cCompanies are struggling to make sure that their intellectual property is maintained and they are not leaking sensitive information about their business practices, about their customers, their user bases,\u201d said Robert Falzon, head of engineering at cybersecurity firm Check Point Software Technologies Ltd.<\/p>\n
What many AI users don\u2019t understand is that whenever they interact with chatbots, their conversations and data are being stored and used to further train those tools, Falzon said.<\/p>\n
For example, an employee could share confidential financial statements or proprietary research on unsanctioned chatbots to generate infographics \u2014 unaware that the sales numbers are now available to people outside the company. Meanwhile, an outsider could land on that data when researching the same subject on the chatbot, unaware that it wasn\u2019t supposed to be publicly accessible.<\/p>\n
\u201cThere\u2019s a chance that the AI might dig back into its resources and training and find that piece of information about your company that talks about the results \u2026 and just nonchalantly provide that to that person,\u201d Falzon said.<\/p>\n
And hackers are using the same tools just like everyone else, Falzon warned. <\/p>\n
A July report from IBM and U.S.-based cybersecurity research centre Ponemon Institute found 20 per cent of the companies it surveyed said they had suffered a data breach due to security incidents involving shadow AI. That\u2019s seven percentage points higher than those that experienced security incidents involving sanctioned AI tools. <\/p>\n
The average cost of a Canadian breach between March 2024 and February 2025 soared 10.4 per cent to $6.98 million from $6.32 million the year before, the report said. <\/p>\n
There\u2019s a need to establish governance around AI use at work, KPMG\u2019s Sadek said. <\/p>\n
\u201cIt\u2019s not necessarily the tech that fails you; it is the lack of governance,\u201d he said.<\/p>\n
That could mean establishing an AI committee with people from across departments such as legal and marketing, to look at tools and encourage adoption with the right guardrails, Sadek said. <\/p>\n
Guardrails should be grounded in an AI framework that aligns with the company\u2019s ethics and helps answer tough questions about security, data integrity and bias, among others, he said.<\/p>\n
One example could be adopting a zero-trust mindset, Falzon said. That means not trusting any devices or apps that aren\u2019t explicitly allowed by the company.<\/p>\n
The zero-trust approach reduces risk and limits what a device will or will not allow an employee to submit in a chatbot, he explained. For example, Falzon said employees at Check Point aren\u2019t allowed to input research and development data and if they do so, the system will restrict and inform the user of the risks.<\/p>\n
\u201cThat\u2019s going to help make sure that customers are both educated and understand what risks they take, but also at the back end of it, make sure that those risks are mitigated by technology protection,\u201d Falzon said.<\/p>\n
Creating awareness is key to smoothing the friction between employers and workers about AI tools, experts say.<\/p>\n
Sadek said holding hands-on training sessions and educating employees about the risks of using unsanctioned AI tools can help.<\/p>\n
\u201cIt significantly reduces the use or holds the users or employees accountable,\u201d he said. \u201cThey feel accountable, especially if they\u2019re educated and have awareness sessions of the risks.\u201d <\/p>\n
In order to keep data contained within internal systems, some companies have started deploying their own chatbots.<\/p>\n
Sadek said it\u2019s a smart way to tackle unauthorized AI tools.<\/p>\n
\u201cThat will help (companies) ensure more security and privacy of their company data, and ensure that they\u2019re built within the guardrails that they already have within their organization,\u201d he said.<\/p>\n
Still, internal tools can\u2019t completely eliminate cybersecurity risks. <\/p>\n
Researcher Ali Dehghantanha said it took him just 47 minutes to break into a Fortune 500 company\u2019s internal chatbot and access sensitive client information during his cybersecurity audit. The company hired him to evaluate its internal chatbot\u2019s safety and check if the system could be manipulated into revealing sensitive data. <\/p>\n
\u201cBecause of its nature, it had access to quite a number of company internal documents, as well as access to communication that different partners were conducting,\u201d said Dehghantanha, a professor and Canada Research Chair in cybersecurity and threat intelligence at the University of Guelph. <\/p>\n
He said big banks, law firms and supply chain companies are significantly relying on internal chatbots for advice, email responses and internal communications \u2014 but many are lacking proper security and testing.<\/p>\n
Companies have to set aside a budget when adopting AI technology or deploying their own internal tools, he added.<\/p>\n
\u201cNot only for AI, for any technology, always consider the total cost of ownership,\u201d Dehghantanha said. \u201cOne part of that cost of ownership is how to secure and protect it.<\/p>\n
\u201cFor the AI at the moment, that cost is significant,\u201d he said.<\/p>\n
Companies can\u2019t stop staff from using AI anymore, Falzon said, so employers need to provide the tools their employees need. <\/p>\n
At the same time, he said, \u201cthey want to be sure that things like data leakage don\u2019t occur and that they\u2019re not creating a greater risk than the benefit that they offer.\u201d<\/p>\n
This report by The Canadian Press was first published Aug. 24, 2025.<\/p>\n
Ritika Dubey, The Canadian Press<\/p>\n","protected":false},"excerpt":{"rendered":"An artificial intelligence chatbot could help quickly clean up your presentation moments before an important board meeting. But…\n","protected":false},"author":2,"featured_media":95131,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[62,276,277,49,48,61],"class_list":["post-95130","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/95130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=95130"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/95130\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/95131"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=95130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=95130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=95130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}