Shadow AI in Australian Organisations: How to Secure Staff Use of AI Without Banning It

Shadow AI is the use of AI tools by staff without oversight from IT or security. It is already inside most Australian organisations, and banning it does not work. The practical answer is to make AI use visible, give people a sanctioned option, set a clear acceptable-use policy, and govern the whole programme to a recognised standard such as ISO/IEC 42001. IBM found that breaches involving shadow AI cost around US$670,000 more than average in 2025.

What is shadow AI, and why is it already in your organisation?

Shadow AI is the workplace cousin of shadow IT: employees using generative-AI tools, usually free public ones, without approval or visibility from the organisation. Someone pastes a customer list into a chatbot to draft an email. A developer drops source code into an AI assistant to debug it. None of it is malicious, and most of it is invisible to security.

There are two fronts to manage, and most guidance only covers one. The first is how your staff use AI: the data that leaves your control when people use public tools. The second is the AI you build: the applications and assistants your own teams create, which introduce a new class of vulnerabilities. A serious AI security programme addresses both.

What shadow AI actually costs Australian businesses

The financial case is now measurable. In its Cost of a Data Breach Report 2025, IBM found that 20% of breached organisations were compromised through shadow AI, that those breaches cost around US$670,000 more than the global average of US$4.44 million, and that 97% of organisations breached through AI lacked proper AI access controls.

The Australian picture shows why. An Okta poll of Sydney and Melbourne organisations (January 2026) found 41% had no single owner of AI security risk, 35% named shadow AI their top blind spot, and while 70% reported board awareness, only 28% said their boards were fully engaged. Accountability, not technology, is the first gap.

Usage is climbing at the same time. Menlo Security (August 2025) reported that 68% of employees use free-tier AI tools through personal accounts, and 57% of them enter sensitive data. Netskope Threat Labs (2025) found data-policy violations in generative-AI use more than doubled year on year, with organisations seeing an average of 223 attempts per month to put regulated data, intellectual property, source code or credentials into AI tools.

Securing how your staff use AI

The goal is control with visibility, not prohibition. Bans push AI use further into the shadows and cost you the productivity your competitors are keeping. Three moves do most of the work.

Get visibility first

You cannot govern what you cannot see. Discover which AI tools are in use, through network and browser telemetry and data-loss prevention (DLP). Netskope’s data shows only about half of organisations apply DLP to generative-AI traffic, which is why so much sensitive data leaves unseen. Detecting anomalous AI and agent activity also ties into managed detection and response.

Offer a sanctioned alternative

People use shadow AI because it helps them work. Give them an approved, enterprise-grade tool with data protections in place, and most shadow use disappears on its own. The safest control is the one staff actually prefer to use.

Set a clear acceptable-use policy

Write a plain-English policy covering what can and cannot be entered into AI tools. The Office of the Australian Information Commissioner’s guidance on commercially available AI products (October 2024) is direct: as a matter of best practice, do not enter personal information into publicly available generative-AI tools. Those obligations sit under the Privacy Act’s Australian Privacy Principles.

Securing the AI applications you build

If your teams are building AI features, chatbots or agents, you have inherited a new attack surface. The OWASP Top 10 for LLM Applications 2025 ranks prompt injection as the number one risk (LLM01), covering both direct manipulation and indirect injection through content the model reads. Sensitive-information disclosure and excessive agency also feature.

The defences are familiar in principle: least-privilege access for whatever the model can call, input and output filtering, human oversight for consequential actions, and adversarial testing of the application before and after release. Red-teaming an AI application surfaces the prompt-injection and data-leakage paths that ordinary testing misses.

Turning controls into governance: NIST AI RMF and ISO/IEC 42001

Point controls are not a programme. Governance is what gives your board, customers and regulators confidence that AI risk is managed. Two frameworks anchor it.

The NIST AI Risk Management Framework and its Generative AI Profile (released July 2024) organise the work into Govern, Map, Measure and Manage, with more than 200 suggested actions. ISO/IEC 42001:2023 goes further: it is the world’s first certifiable AI management system standard, giving you an auditable framework and independent evidence that AI is managed responsibly. CyberPulse helps organisations establish and certify against it through our ISO 42001 services.

Local and international expectations are converging. Australia’s Voluntary AI Safety Standard sets out ten guardrails, and Gartner predicts that more than 40% of enterprises will experience a security or compliance incident linked to unauthorised AI by 2030 (Gartner, November 2025). For organisations serving European customers, the EU AI Act adds obligations on a staged timeline, and Gartner separately predicts that more than 40% of AI-related breaches will stem from improper cross-border AI use by 2027 (Gartner, February 2025).

A 90-day plan to bring shadow AI under control

• Days 1 to 30: Discover current AI use across the business. Assign a single owner for AI risk. Draft an acceptable-use policy.
• Days 31 to 60: Roll out a sanctioned AI tool. Apply DLP and browser controls to public AI traffic. Brief the board on exposure and ownership.
• Days 61 to 90: Test any AI applications you build against the OWASP LLM Top 10. Map your controls to the NIST AI RMF and plan the path to ISO/IEC 42001.

None of this requires banning AI. It requires making its use visible, governed and accountable.

Frequently asked questions

What is shadow AI, and how is it different from shadow IT?

Shadow AI is the use of AI tools, usually public generative-AI services, without organisational approval or oversight. It is a subset of shadow IT, but the risk is sharper because sensitive data entered into a public model can leave your control instantly and be difficult to recall.

Is it illegal for staff to use ChatGPT at work in Australia?

It is not illegal in itself, but entering personal information into public AI tools can breach obligations under the Privacy Act. The OAIC advises against putting personal information into publicly available generative-AI products as a matter of best practice.

Should we ban public AI tools entirely?

Banning rarely works. It pushes usage underground and removes visibility. A sanctioned tool plus a clear policy and monitoring controls the risk while keeping the productivity benefit.

What is prompt injection, and does it affect us if we only use vendor AI?

Prompt injection is manipulating an AI application through crafted input so it ignores its instructions or leaks data. It is the top risk in the OWASP LLM Top 10 2025. It mainly affects AI you build or configure, but understanding it helps you assess the vendor AI you rely on.

Does ISO/IEC 42001 apply to organisations that only use, not build, AI?

Yes. ISO/IEC 42001 governs how an organisation manages AI, including its use of third-party AI systems, not just AI it develops. It gives users a certifiable framework for responsible AI governance.

Who should own AI security risk: the CISO, IT, or the board?

Day-to-day ownership usually sits with the CISO or security lead, but the board remains accountable for material risk. The Okta poll found 41% of organisations had no clear owner at all, which is the first gap to close.

Secure both sides of your AI use

CyberPulse secures how your team uses AI and protects the AI you build, governed to ISO/IEC 42001 and monitored around the clock. To see where your exposure sits and how to close it, explore our AI security services or get in touch.