Enterprise IT + regulated startup (2025–2026 pattern) · 2025 · cost index 4/5
Shadow AI — tickets and logs in consumer chat
Compliance scramble; vendor DPA retrofit; partial customer notification
What happened
Engineers pasted production tickets, stack traces, and customer identifiers into consumer AI chat because the sanctioned portal was slow and locked down. InfoSec discovered the pattern after a vendor questionnaire — not before. Governance decks arrived after the data had already left the building.
Failure mode
Policy-by-slide while usable approved tooling lagged real workflows. Convenience beat blocked portals. Data classification existed on paper; paste was faster than process.
Lesson
Shadow AI is low-code's cousin with a better demo. Ship usable sanctioned paths, classify what may leave the network, and assume convenience wins until the approved tool is as fast as paste.
Sources
- Industry pattern — unsanctioned LLM data exposure
- Privacy regulator guidance — generative AI and personal data
- InfoSec retrospectives — shadow IT with chatbots
Related tech
Practice · 2023–now
Shadow AI / paste-into-ChatGPT
Prod data into consumer chat because the approved tool is slow. GDPR with better autocomplete.
$ Employees routed tickets, logs, and customer PII through consumer chat before InfoSec finished procurement. Compliance scramble followed the demos.
Practice · 2018–2025
Low-code will replace eng
Drag-and-drop apps for the enterprise backlog. Useful for internal tools; fantasy as a full replacement for engineering — a pitch later absorbed by AI demos.
Practice · 2023–now
Prompt injection as afterthought
Ship the chatbot, bolt on security later — OWASP's new category, same old afterthought.
$ Customer-facing chatbots shipped with tool access and "security in phase two." Indirect injection via docs and tickets became the new XSS.
Practice · 2023–now
Local inference
Run the model on your laptop or rack. Privacy, cost control, and the refusal to send every token to a vendor.
Practice · 2021–now
AI pair programming
Autocomplete that understands the file — now table stakes. Generation outran review capacity; ownership is the bottleneck.