Security Alerts

The State of Shadow SaaS and AI: Understanding the Risks

Explore the risks of Shadow SaaS and GenAI, and learn how to mitigate them with effective security strategies.
Share on social media
TL;DR - A survey of 250 security professionals revealed that 73% admitted to using unauthorized SaaS applications, despite knowing the risks such as data loss, lack of visibility, and data breaches. Organizations need to implement better visibility, strict access controls, and employee training to manage these risks. ThreatKey provides comprehensive solutions to detect and control Shadow SaaS and manage GenAI usage, ensuring data security and compliance.

In today's digital landscape, the adoption of Generative AI (GenAI) tools is transforming how organizations operate. These technologies offer immense benefits in scalability, efficiency, and innovation. However, they also introduce significant challenges, particularly when employees use unsanctioned applications without the knowledge or oversight of IT departments. This phenomenon, known as Shadow SaaS, along with the emerging risks of GenAI, presents serious data security concerns. To explore these issues, we turn to insights from a recent survey conducted among over 250 security professionals at RSA Conference 2024 and Infosecurity Europe 2024.

Survey Insights

The survey of 253 global security professionals revealed a concerning trend: nearly three-quarters (73%) admitted to using SaaS applications that were not provided by their company’s IT team in the past year. Despite their awareness of the risks, such as data loss (65%), lack of visibility and control (62%), and data breaches (52%), one in ten respondents confirmed that their organization had suffered a data breach or data loss as a result of Shadow SaaS usage.

Moreover, while there is a noticeable laissez-faire attitude towards Shadow SaaS, security professionals are more cautious about GenAI. Half of the respondents indicated that AI use had been restricted to specific job functions, with 16% banning the technology entirely. Additionally, 46% of organizations have implemented tools and policies to control GenAI usage.

Risks Associated with Shadow SaaS and AI

The unauthorized use of SaaS applications and GenAI tools poses several significant risks:

  • Data Loss: Sensitive information can be easily leaked or lost when using unsanctioned applications.
  • Lack of Visibility and Control: IT departments struggle to monitor and manage data flows in and out of unauthorized tools.
  • Data Breaches: The expansion of the attack surface increases the likelihood of breaches, compromising sensitive company data.

Current Practices and Policies

Despite recognizing these risks, many organizations have not fully addressed them. The survey revealed that only 37% of security professionals had developed clear policies and consequences for using unauthorized tools. Even fewer (28%) promoted approved alternatives. Only half had received guidance and updated policies on Shadow SaaS and AI in the past six months, and one in five admitted to never receiving such updates.

Mitigation Strategies

To effectively mitigate the risks associated with Shadow SaaS and AI, organizations need to adopt several key strategies:

  • Visibility and Monitoring: Implement tools that provide full visibility into all SaaS applications used within the organization, including unauthorized ones.
  • Strict Access Controls: Enforce strict access controls to limit the use of unsanctioned applications.
  • Training and Awareness: Develop comprehensive training programs to educate employees about the risks and proper usage of SaaS and AI tools.
  • Promoting Approved Alternatives: Encourage the use of approved, secure alternatives to unsanctioned tools.

The survey highlights a critical need for better management and understanding of the risks associated with Shadow SaaS and GenAI. By implementing robust visibility, monitoring, and policy enforcement strategies, organizations can significantly reduce their exposure to these risks. ThreatKey offers a strategic response, providing comprehensive tools to manage and secure SaaS and AI usage effectively.

For further insights or to learn more about ThreatKey's solutions, contact our team for a personalized demonstration.


What is Shadow SaaS?
‍Shadow SaaS refers to the use of SaaS applications by employees without the knowledge or approval of their IT department.
Why is Shadow SaaS a security risk?
‍Shadow SaaS increases the risk of data breaches, loss of sensitive information, and lack of control over data flows, as IT departments are unaware of the applications being used.
How can organizations detect and control Shadow SaaS usage?
‍Organizations can use tools like ThreatKey to gain visibility into SaaS applications, monitor data flows, and enforce security policies.
What are the best practices for managing GenAI usage in the workplace?
‍Best practices include restricting AI usage to specific roles, monitoring AI-generated content, and integrating with AI APIs to ensure compliance.
How does ThreatKey help mitigate the risks associated with Shadow SaaS and AI?‍
ThreatKey offers comprehensive visibility, monitoring, policy enforcement, and training tools to manage and secure SaaS and AI usage effectively.
Most popular
Subscribe to know first

Receive monthly news and insights in your inbox. Don't miss out!

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.