- From Chaos to Clarity: Cybersecurity Leadership Lessons - November 13, 2025
- Hopepunk in Cybersecurity: Radical Humanity Meets Creative Defense - September 10, 2025
- The Enterprise AI Balancing Act: Innovation vs. Security - May 15, 2025
“Necessary Evil”
This colloquial term is used to describe events, objects, and anything that is required or impending that we’d wish there were options to handle.
As we discuss considerations and consequences to approaches in discovering and securing Software-as-a-Service (SaaS) and the many forms of generative AI within an organization, this term is likely not too far from any security practitioner’s mind.
Not all technological advances will dramatically uplevel an organization without significant planning, and rarely, if ever, will they be inherently secure to implement. However, constant change and increasing demands on technology across spectrums are unavoidable.
These truths dig further into operations teams’ minds when approaching the discovery and protection of any “shadow” (unknown and unapproved) use within an organization.
Of all the concerns pushing and pulling their way into technical operations, there are some fundamental underpinnings to consider when evaluating a solution.
Amplifications for this Concern
SaaS offerings like Salesforce, Office 365, Shopify, and Workday were created to provide organizations with easy access, use, and maintenance structures for software and applications designed to meet every business need.
In the constant race to remain the most relevant in the market, most of these services are also quick to promote the use of AI in various parts of their systems. While for some, this was just a renaming of the machine learning and training that had already existed, others were pressured to develop and release as quickly as possible to meet the demands.
Headlines already exist for applications whose quick development and popularity were wrought with security flaws and outright misses. When nearly everything centers around data, security can’t be an afterthought.
But data also lives everywhere, and your users are constantly creating, touching, and moving it. When systems are designed to help users complete tasks, carry out objectives, and ‘move faster’ while doing so, measures must be in place to protect the data from going where it doesn’t belong and can’t be monitored. The intent does not have to be malicious for your data to find its way into the wrong hands or public back-ends.
For example, copying and pasting data into a generative AI tool may help produce more content, but are you sure you have a complete view of all the tools being used and by whom?
Chasing Your Shadows
We have the “known knowns,” those systems that your IT and security teams are aware of, which were assessed and documented. Ideally, you also have an AI survey of where and why AI may be used.
While that’s a nice plan, when the average number of SaaS applications used by an organization is over 100, that becomes a monumental ask of any team.
All the while, your users are also consumers outside of the office, who know they can sign up for demos and accounts across all that the internet has to offer. Each one has a potential for leaked data and the “I didn’t know it did that” response when discovered and assessed to be a risk. These shadow systems are now your “unknown unknowns” the most uncomfortable truth in this entire conversation.
What could make this already uncomfortable topic slightly worse? They’re probably using free accounts!
In the June 2024 webinar “The State of the Dark Web”, the Flare.io team used a line that has lived in my head ever since: “Nothing is really free…”
These applications will still house the information on users created and data entered, learn from the data or products used, and even retain it. In contrast, the user may have deserted at some point for another tool or at the project’s completion. The conversation then darkens when we remember the increasing number of third-party breaches and their impact on their customers down the line.
There are products and services in the market today that tackle this unease and create actionable tasks in response to these events, both in the discovery and monitoring of SaaS accounts and generative AI use.
One of the best parts? They don’t require a million web app firewall, EDR, or RDP rules and the burden those cause on your teams and the systems themselves. This is an attainable level of protection and visibility.
Learning to Love GRC
Governance, Risk, and Compliance (GRC) is an approach and strategy, accompanied by some very interesting toolsets, to help an organization connect their operations, technologies, and administrative controls. GRC is a team sport like all its neighboring cyber domain components. There are many stakeholders and contributors whose decisions on policies and how they are implemented can ripple through an organization.
Just having a policy doesn’t stop something from happening, so compliance itself isn’t what stops attacks. It’s the purposeful and mindful implementation of resources to enforce needed protections.
In the context of this conversation, Acceptable Use and Responsible Use Policies can tell users the rules about how to use applications, what data structures they are allowed to access, the process for requesting and using unapproved applications (including AI like ChatGPT), and how they’re expected to access corporate resources from a personal device.
Plus, these policies can also help guide decision-makers on the requirements for assessing and purchasing new applications and tools.
With AI in particular, specific user training and awareness are needed in addition to policies, customer notices, and vendor tracking.
As Hanlon’s razor suggests, ‘Never attribute to malice that which is adequately explained by stupidity.” Users are certainly not stupid; instead, they’re uninformed and untrained on the use and risk associated with their actions in using highly commoditized tools with company data and resources.
When teams address ongoing demands for monitoring and maintaining the “known knowns” we also recall how quickly changes to these seemingly safe systems can also occur.
For example, the availability of feature sets utilizing AI tools to record, transcribe, and analyze phone calls and emails. While it may speak to management’s desire to move faster and gain deeper insights from all this collected data, it’s a nightmare for privacy. The collection consent, appropriate storing and labeling, as well as the AI learning against data that wasn’t consented to by a far-end user or business partner, are all legitimate business risks. The concern around these risks increases the more regulated of an industry you operate in.
We also think about the challenge of copyright infringement and the challenges in identifying what could be protected works within your internal or external materials. This challenges not just marketing, education, and other research entities but teams generating training content and knowledge bases. This is a contentious topic, especially as AI regulations worldwide continue to tackle this subject.
Protecting SaaS and AI Utilization is Possible
Yes, SaaS and GenAI tools are used in approved and unapproved means. And, yes, your users are likely using software and creating accounts you aren’t aware of. However, protections exist in many layers, and there are ways to begin controlling their spread and shielding your organization from fines and data leaks.
Sign up for our webinar on March 19, 2025 at 10am PST | 12pm CST | 1pm EST, where we’ll discuss this and more with a panel of top cybersecurity experts. You’ll learn:
- The mindset and tools available to discover shadow SaaS and AI use.
- How to protect your organization and data from improper access.
- Best practices and considerations on data security.
- How your GRC approach could help your teams save the day.
