The UK’s National Cyber Security Centre (NCSC) is warning organizations that employees’ use of unapproved AI tools is creating new risks around sensitive data exposure, visibility, and cybersecurity controls as workplace AI adoption accelerates.
Shadow AI creates a security blind spot
According to the NCSC, the risks associated with shadow AI introduce new opportunities for attackers to harm UK businesses.
“Rather than preventing them from using AI, this can mean employees turn to using AI tools that have not been approved by their organization, introducing new cybersecurity risks that can be hard to identify,” the NCSC states.
The guidance cites research from Microsoft, which found that 71% of UK employees have used AI tools that were not employer-approved.
Our coverage of TrustedTech’s 2026 AI report also highlights the importance of leaders and individual contributors alike understanding the risks of shadow AI use.
The NCSC warns that organizations need to crack down on unapproved use, stating:
“Where cybersecurity policies cannot meet business needs, organizations are likely to continue seeing their employees adopt new AI services before they have had time to assess them and provide approved alternatives. This trend is likely to be reinforced as AI capabilities become increasingly affordable and readily available.”
Guidance emphasizes careful approach to AI
The NCSC emphasizes that it is not recommending that individuals stop using AI, but rather that they use these tools to assist with work tasks and think carefully about which apps and services they use before sharing data.
The challenge for organizations, NCSC notes, is ensuring employees have access to AI tools that meet their needs while managing cyber risk.
NCSC recommends that organizations should:
- Adopt a positive cybersecurity culture – one that encourages open communication about cybersecurity issues, making employees much less likely to turn to shadow AI services.
- Securely integrate AI systems into the workplace and refer to the NCSC and international partners’ guidance on careful adoption of agentic AI services.
The UK channel angle
The warning from the UK agency is one that channel organizations should heed, as shadow AI poses a new security management challenge.
As a result, customers will increasingly need help discovering, governing, and securing unauthorized AI usage.
MSPs and MSSPs can potentially package AI discovery and governance into managed security services, as some have already started.
Further, UK and European Union regulatory requirements increase the importance of controlling enterprise AI. This creates an opportunity for security vendors and MSSPs to build new recurring services around those controls to keep end customers aligned to regulatory standards.