28 September Blog

​AI in a Tight Economy: How Businesses Can Embrace AI Without Creating Tomorrow’s Cyber Crisis

For many businesses, the attraction of artificial intelligence is becoming difficult to ignore. Margins are under pressure. Customers expect faster responses. Employees are being asked to achieve more with fewer resources. Management teams are looking for productivity improvements, while Boards want costs controlled without compromising growth.
Against that backdrop, AI can look extremely attractive. A relatively inexpensive AI tool might help an employee produce in minutes what previously took hours. It can assist with research, analyse information, prepare reports, automate administrative work, support customer service and help people make better use of the information already sitting inside the business.
The question is therefore rapidly changing from: “Should we allow AI?” to: “How do we take advantage of AI without introducing risks we don't properly understand?”
That distinction matters, because while businesses are discovering how AI can make them more productive, cyber criminals are discovering exactly the same thing. And cybersecurity providers are responding with AI of their own. We are entering an environment in which AI is increasingly being used on all three sides of the equation:
Businesses are using AI to work more efficiently.
Attackers are using AI to attack more effectively.
Defenders are using AI to detect and respond more intelligently.
That fundamentally changes the cybersecurity conversation.
The economic argument for AI is compelling
When budgets are tight, telling businesses simply to avoid AI is neither realistic nor necessarily good advice, AI may actually be part of the solution to financial pressure. A small organisation may be able to use AI to improve marketing, analyse contracts, summarise meetings, prepare proposals, interrogate business data, automate repetitive tasks and increase the productivity of existing staff.
The problem isn't necessarily AI, the problem is unmanaged AI.
An organisation can quite easily reduce operating costs in one area while quietly creating a potentially much larger exposure somewhere else.
Consider an employee who discovers an AI tool that saves them three hours every week. From their perspective, that's innovation. But what information are they putting into it?

• Customer information?
• Financial data?
• Contracts?
• Intellectual property?
• Employee records?
• Board papers?
• Strategic plans?
• Passwords, source code or system configurations?

Where does that information go? Is it retained? Can it be used for training? Who owns the resulting output? Has anyone assessed the provider? And does the organisation even know the tool is being used?
This is where Shadow AI becomes particularly important. Employees don't necessarily adopt unsanctioned AI tools because they're careless. Often, they do it because they're trying to do their jobs better.
That makes AI governance as much a culture and leadership challenge as it is a technology challenge.
But what if you didn't choose the AI?
There is another AI risk emerging that may prove harder to manage than employees signing up for ChatGPT or another public AI service.
AI is increasingly being embedded inside the software businesses already use.
Your CRM provider adds an AI assistant, your accounting platform introduces AI-powered analysis, Microsoft, Google and other productivity platforms introduce AI capabilities. Your HR, marketing, customer-service, cybersecurity or project-management software adds AI features through an update.
Suddenly an organisation can be using significantly more AI than management realises — without anybody making a conscious decision to introduce another AI platform.
This creates a different governance challenge; we might call it Embedded AI Risk.
Shadow AI and Embedded AI are not the same problem. Shadow AI generally occurs when employees independently adopt AI tools without formal organisational approval. Embedded AI is different, the underlying software may already be approved, the vendor may already have passed procurement, the organisation may already have a contract and established relationship with the supplier. But the capabilities of the product have changed. That raises an important governance principle:
Approving a software provider once should not automatically mean approving every future AI capability that provider introduces.
An application that was assessed two years ago as a relatively conventional SaaS platform may now contain generative AI, automated decision-making, AI agents, data-analysis capabilities or connections to third-party AI models that didn't exist when the original risk assessment was completed.
The organisation therefore needs to understand not only which applications it uses, but increasingly what AI capabilities now exist inside those applications.
This requires a different AI strategy
Traditional software governance often focuses heavily on procurement, we assess a supplier, sign a contract, approve the application and move on. AI makes that increasingly inadequate. Organisations may need to move towards continuous technology governance, where significant changes to existing platforms trigger another conversation.
That doesn't mean reassessing every software update, it means identifying material changes that could alter the organisation's risk. For example:

• Has the provider introduced generative AI?
• Can the AI access our organisational data?
• What information can it analyse?
• Can it access emails, documents, customer records or financial information?
• Is our data being sent to another AI provider or model?
• Can our information be used to train or improve models?
• Has the vendor changed its privacy or data-retention arrangements?
• Can the AI take actions, or does it merely provide recommendations?
• Can administrators disable or restrict the AI functionality?
• Are AI features switched on automatically?

These questions should increasingly become part of supplier and third-party risk management.
Create an AI Capability Register — not simply an AI Tool Register
Many organisations considering AI governance start by creating a register of approved AI applications. That's useful, but it may no longer be enough, instead, organisations could maintain an AI Capability Register.
Rather than simply recording: “We use Software X.” the organisation records: “Software X contains these AI capabilities, can access these categories of organisational information, performs these functions, has these permissions and is subject to these controls.” That subtle change could provide Boards and management with a much clearer picture of their actual AI exposure. The register doesn't need to become another expensive compliance exercise.
For smaller businesses, it could initially be a straightforward spreadsheet covering:
Application | Business Owner | AI Capability | Data Access | AI Provider/Model | Business Purpose | Risk Level | Human Oversight | Approved/Restricted/Disabled | Last Reviewed
Suddenly the organisation has something extremely valuable: visibility, and you cannot effectively govern something you cannot see.
Ask vendors to disclose material AI changes
Organisations should also consider changing the questions they ask technology suppliers. Rather than asking once during procurement whether a product uses AI, supplier agreements and reviews could increasingly ask providers to disclose material changes to AI functionality.
For example:
“Please notify us when material AI capabilities are introduced or materially changed, particularly where those capabilities affect our data, security, privacy, automated decision-making or third-party processing.”
For larger or higher-risk suppliers, organisations may want appropriate notification and review provisions reflected in contracts and procurement requirements. This becomes particularly important when AI functionality involves sensitive information or critical business processes.
Beware of the 'trusted supplier' assumption
There is also a human tendency worth considering, when employees see an AI button inside an application the company already provides, they may reasonably assume:
“IT has approved this, so it must be safe.”
But that may not necessarily be true, the application may be approved, the new AI capability may never have been assessed.
That distinction needs to become part of AI awareness training. Employees shouldn't have to become AI risk specialists. They simply need an easy way to ask: “This application has just introduced an AI feature. Are we okay to use it with company information?” That question should be encouraged rather than treated as an inconvenience.
AI governance therefore needs three lines of visibility
This changes the AI governance model considerably, businesses increasingly need visibility across three different forms of AI adoption:
1. Approved AI — AI systems deliberately selected, assessed and authorised by the organisation.
2. Shadow AI — AI tools independently adopted by employees or departments without appropriate approval.
3. Embedded AI — AI capabilities introduced into software and platforms the organisation already uses.
The third category may eventually become the largest. And because it is largely invisible, it could also become one of the easiest to overlook.
The Board question changes again
Boards shouldn't therefore ask only: “Which AI tools have we approved?”
A much stronger question is: “Where does AI currently exist across our organisation — including inside technology we already owned before it became AI-enabled?”
And perhaps the follow-up question is even more important:
“Would we know if one of our critical technology suppliers materially changed how AI interacts with our information tomorrow?”
If the answer is no, the organisation may have discovered an important gap in its AI governance strategy. Because in the next stage of AI adoption, organisations won't always make a conscious decision to introduce AI.
Sometimes AI will simply arrive in the next software update.
Good governance therefore needs to evolve from controlling the AI tools people deliberately adopt to maintaining visibility over the AI capabilities continuously emerging throughout the organisation's technology ecosystem.