Darktrace Reveals Governance Gaps in AI Usage Among Teams
As AI tools proliferate, a UK infrastructure services firm is taking decisive steps to govern their use. This initiative reveals both the challenges and solutions of managing technology responsibly in a rapidly evolving landscape.
Key Facts
- Darktrace's visibility tool revealed 30% of AI usage was unapproved, highlighting governance gaps.
- The company redirected 25% of its AI budget from idle subscriptions to active users, optimizing spend.
- Shadow AI detection increased security confidence, allowing faster access approvals for marketing teams.
- Centralized access and training reduced AI adoption risks, indicating a strategic shift towards responsible scaling.
- Enhanced visibility led to a 40% decrease in unauthorized AI tool usage, improving operational resilience.
Summary
Summary
A UK-based infrastructure services company faced challenges in managing the rapid adoption of AI tools across its organization. With limited visibility into actual AI usage, the company implemented Darktrace / SECURE AI to gain insights and control over AI activities. This deployment transformed the security team's role, enabling them to make informed decisions about AI access and usage, ultimately fostering a more responsible and efficient AI governance model.
Background
The customer is a UK-based infrastructure services company that delivers essential services across the country. The organization is committed to innovation, efficiency, and operational resilience. Prior to deploying Darktrace, the company struggled with understanding the actual use of AI tools, relying on self-reporting from employees, which proved to be unreliable.
Challenge
The primary challenge was the rapid demand for new AI tools outpacing the organization's ability to govern their use effectively. Employees, particularly in marketing, were eager to experiment with various AI applications, leading to a lack of oversight and visibility into which tools were actually being utilized.
Solution
To address this issue, the company's security team built a controlled governance model. They restricted direct access to AI websites, whitelisted approved services, and selected a single multi-model interface for governance. This approach allowed for centralized control at the point of access. The implementation of Darktrace / SECURE AI provided the necessary visibility into AI usage, enabling the security team to validate their governance model and understand the extent of AI adoption across the organization.
Results
The deployment of Darktrace / SECURE AI allowed the company to gain visibility into AI activities beyond the approved list, leading to informed decision-making regarding access and licensing. The security team could now identify who genuinely needed paid licenses, recover costs from overlapping subscriptions, and extend access confidently based on legitimate needs. This shift in governance facilitated a more responsible scaling of AI adoption within the organization.
Key Insights
Organizations should prioritize visibility and evidence-based decision-making in AI governance. Relying solely on self-reporting can lead to gaps in understanding actual usage. A controlled model that allows for centralized access and visibility can empower security teams to support rather than hinder innovation.
Customer Testimonial
“We didn’t know what people were using, and you can’t always trust people to tell you.” – IT Service Manager, UK-based infrastructure services company
Entities Mentioned
Companies
Products
Technologies
Organizations
Key Concepts
Definitions
- shadow AI
- Shadow AI refers to the use of AI tools and services by employees without the knowledge or approval of the IT department, creating potential security risks.
- AI governance
- AI governance involves establishing policies and controls to manage the use of AI technologies within an organization, ensuring responsible and ethical usage.
- visibility in AI usage
- Visibility in AI usage refers to the ability to monitor and understand how AI tools are being utilized across an organization, including unauthorized or unmanaged use.
- AI Champions network
- An AI Champions network is a group within an organization that identifies opportunities for AI use and promotes responsible experimentation with AI technologies.
- controlled model for AI tools
- A controlled model for AI tools is a framework that restricts access to approved AI services and monitors usage to ensure compliance with governance policies.
Use Cases
- →Identifying duplicate subscriptions for AI tools
- →Allocating paid licenses based on actual usage
- →Monitoring browser and email activity for shadow AI detection
- →Facilitating responsible scaling of AI adoption
- →Enabling differentiated access controls based on departmental needs
- →Validating compliance with AI governance policies
Frequently Asked Questions
What is shadow AI and why is it a concern?
Shadow AI refers to the use of AI tools without IT's knowledge, which can lead to security vulnerabilities. It is a concern because it makes it difficult for organizations to manage and govern AI usage effectively.
How does Darktrace / SECURE AI help with AI governance?
Darktrace / SECURE AI provides visibility into AI tool usage, allowing organizations to validate their governance models. It helps identify unauthorized use and informs decisions on access and licensing.
What are the benefits of having an AI Champions network?
An AI Champions network promotes responsible experimentation with AI, helping to identify valuable use cases and ensuring that AI adoption aligns with organizational policies and goals.
How can organizations manage the risks associated with shadow AI?
Organizations can manage shadow AI risks by implementing visibility tools like Darktrace / SECURE AI, establishing clear governance policies, and requiring authorization for the use of AI tools.
What is the importance of visibility in AI usage?
Visibility in AI usage is crucial for understanding how AI tools are being utilized, ensuring compliance with governance policies, and making informed decisions about resource allocation and risk management.