Why employees, not threat actors, are 2026s biggest risk

Date:
Thu, 13 Aug 2026 09:48:16 +0000

Description:
Shadow AI is exposing businesses to hidden employee-led risks, demanding stronger identity security and visibility.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter With all the buzz around nation-state threats, its easy for organizations to focus on threats outside the business and forget about risks that can spiral outwards from within.

Whilst GenAI tools have introduced undeniable efficiencies for employees , these platforms have also introduced a new class of risk: two in three UK organizations admit they cant track whether employees are sharing data via approved tools. Most of the time, employees arent sharing sensitive data because they have malicious intentions. They are uploading sensitive information like contracts, client proposals or supplier agreements to
models like ChatGPT and Claude to save time on routine tasks. Latest Videos From TechRadar Watch full video here: Steve Bradford Social Links Navigation

Steve Bradford is SailPoint's Senior Vice President, EMEA. Almost all (93%)
of CEOs across the globe have adopted generative AI to some extent in the
past 12 months (PwC). Whats concerning is that much of this activity is happening without any oversight, in the browser meaning organizations are failing to track the flow of company information, including when and where
its uploaded.

This is spiraling into serious risk for businesses. You may like Cracking
down on shadow AI is making your business less secure, not more Shadow AI often emerges when workplace technology fails employees Shadow AI is a business design problem, but it can be overcome

First, because employees may inadvertently share credentials or other access details with public LLMs, which could result in unauthorized access if the model is compromised.

Second, uploading personal data to LLMs can trigger compliance breaches with laws like GDPR and the Data Use and Access Act resulting in costly fines as well as reputational damage. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

To take control of this issue, leaders will need to implement tools and technologies that provide visibility and control over usage at both the browser and the application levels. The incentive problem Employees dont need more mandatory cybersecurity training the problem is incentive. Many company-owned gated LLMs are still in the pilot stage, falling short of the speed and precision offered by public alternatives.

While the majority of employees understand the risks, 35% of UK businesses admit data sharing through external tools takes place indicating many would rather throw caution to the wind than waste valuable time using slower tools. What to read next Shadow AI a step too far, or an opportunity? You fix it by making the secure option just as fast and frictionless as the risky one: Practical advice on addressing shadow AI The AI security paradox: Why are organizations trusting what they cant fully see?

But the risks of this behavior particularly in highly regulated sectors like financial services, could mean unsanctioned LLMs become 'hidden icebergs in
an organization. Concealed, but capable of causing catastrophic damage upon impact like inadvertently exposing customer transaction histories or credit scores.

Part of curbing Shadow AI use in the enterprise therefore starts with designing approved AI tools that integrate easily with existing platforms
(for example, Microsoft 365 and Google Workspace). These tools should be continuously improved based on user feedback, ideally avoiding excessive restrictions that make the tool frustrating to use.

But the fact is, nearly two-thirds of organizations are currently stuck in
the pilot stage when it comes to their AI initiatives and havent started to scale across the enterprise (McKinsey). So, what can organizations do today
to gain control of the Shadow AI problem? The solution tools to bring unsanctioned AI usage under control You cant control what you cant see, which is why organizations need a real-time view of who, or what, is accessing what data, from which devices, and where its being shared.

Next-gen identity security platforms can help organizations to gain an immediate understanding of how employees interact with consumer AI tools like ChatGPT, Claude, and Gemini, tracking interaction frequency and monitoring document uploads.

Once high-risk behavior is identified, organizations can then automate corrective actions, redirect users to secure AI alternatives, or prompt users to justify their business use case before proceeding.

Visibility will become even more important with the emergence of nested agents. In this scenario, employees might believe theyre only interacting
with a single AI agent, but that chatbot may delegate tasks to multiple underlying agents. The organization has no visibility into how many
downstream agents or services its information is being shared with.

An identity security tool makes these identities discoverable via a real-time agent ledger. This ledger acts as a complete, unchangeable trace of all agent activities and interactions. It also applies controls to each agent in the database.

Only the absolute minimum privilege required for a task is granted, at the exact moment it is needed, and for the shortest possible duration. In this way, agent permissions dont automatically cascade. If an agent wants to connect with another agent, it must be verified by the system first. Closing the visibility gap Shadow AI is more than a tooling problem: its an identity problem. Organizations can close the visibility gap by using tools that track interaction frequency, block sensitive document uploads, and prompt employees as well as AI agents to justify their business case before they use unsanctioned tools.

Once organizations know which tools are being used, what data they're accessing, and where that information goes, they can apply effective guardrails to secure behaviors both human and non-human. A simple inventory of AI agents is not enough; now, organizations need to move beyond flat inventories and develop an understanding of the context and relationships
that surround every agent.

In essence, identity security platforms become adaptive moving from static
to dynamic, real-time approaches to access. This is helping organizations to operationalize zero trust by ensuring that no identity, human or non-human,
is trusted by default.

In the era of AI agents, securing identity has become a prerequisite for innovation. We've featured the best AI tool. This article was produced as
part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/why-employees-not-threat-actors-are-2026s-bigges t-risk


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)