DNSFilter Finds Gaps in Shadow AI Oversight

DNSFilter said in a report published Tuesday that companies are failing to close cybersecurity gaps tied to shadow AI, even as security spending rises. The findings come from interviews with 400 IT and cybersecurity workers. Three-quarters said their budgets had increased over the past 12 months, and roughly one-fifth reported growth of more than 10%.

Four in 10 respondents said their next security dollar would go to AI security and governance, compared with 25% who named cloud security. DNSFilter said increased spending must be paired with stricter technical and human policies, because many organizations still have lax AI rules that let security weaknesses enter corporate networks.

Nearly half of respondents (46%) said they were confident unapproved AI apps were connected to their companies’ systems, and one-fifth said an unapproved AI integration had caused a cybersecurity incident. Thirty-seven percent said they learned only after the fact that employees had connected AI apps to work accounts; another 7% said employees did not have to notify IT about such connections. DNSFilter characterized that as 44% of organizations in which someone who does not own the risk decides to connect an AI tool to company data.

Security tool oversight was also uncertain: 62% of respondents were unsure whether all their tools were properly configured, and the same share could not say whether all tools were actively monitored. DNSFilter warned that governance spending does not itself ensure governance, because tools may connect to company systems without being visible to security teams.

DNSFilter said in a report published Tuesday that companies are failing to close cybersecurity gaps tied to shadow AI, even as security spending rises. The findings come from interviews with 400 IT and cybersecurity workers. Three-quarters said their budgets had increased over the past 12 months, and roughly one-fifth reported growth of more than 10%.

Four in 10 respondents said their next security dollar would go to AI security and governance, compared with 25% who named cloud security. DNSFilter said increased spending must be paired with stricter technical and human policies, because many organizations still have lax AI rules that let security weaknesses enter corporate networks.

Nearly half of respondents (46%) said they were confident unapproved AI apps were connected to their companies’ systems, and one-fifth said an unapproved AI integration had caused a cybersecurity incident. Thirty-seven percent said they learned only after the fact that employees had connected AI apps to work accounts; another 7% said employees did not have to notify IT about such connections. DNSFilter characterized that as 44% of organizations in which someone who does not own the risk decides to connect an AI tool to company data.

Security tool oversight was also uncertain: 62% of respondents were unsure whether all their tools were properly configured, and the same share could not say whether all tools were actively monitored. DNSFilter warned that governance spending does not itself ensure governance, because tools may connect to company systems without being visible to security teams.