AI is here, and it can offer ways to streamline tasks and boost efficiency. Unchecked, AI can provide challenges and potential risks to business or personal security. Shadow AI is the term used when employees might add an AI program, often with the best of intentions to make work better or easier, but without telling the proper IT officials or departments. This can result in data leakage or worse. To learn more about shadow AI, we asked Chris Wright, partner and lead security engineer at Little Rock-based Sullivan Wright Technologies, to explain further.
Wright: So if you're using a free account, a lot of those are either set to use the data that you import into there to train the model. So at that point, you're kind of throwing your sensitive data into this big vat of soup and somebody else can come by and scrape out your sensitive data in their ladle of soup and see what you put in there. A lot of them, actually, that's kind of the only way you can do it. If you're using the free model, you're less of the client, more the product because they're having to get something back for giving you that for free.
But some of them, like Claude, you can go configure it to not use your information to train the model, but in the individual and the free models, you have to go configure that deliberately because it is off by default. Whereas if you go and pay for it, it's automatically set to don't use my data to train the model kind of thing. But other ones like Gemini, Google is fairly notorious for hoovering up data to train their advertising, train their AI and stuff like that. ChatGPT is kind of the same way. So if you're using a free model, more likely than not that data is going back into train that model. If you are using a paid model, then it's probably set to use your data to train the model by default, but you can go turn that off. But a lot of folks don't understand that, they just buy it and they start using it. They don't go through and look at all the configuration items like we would.
Kellams: You mentioned small businesses don't have the ability, the resources, perhaps to put all the roadblocks up for protection. What would your advice to a small business just be hey, look, before anyone puts anything on here, let us know?
Wright: For our businesses, yes. And we've had several, we've not had the massive uptick like a lot of the folks in Silicon Valley want you to believe, but we have had clients that are interested in doing that. And I really appreciate them because we get to sit down with them and kind of work through things with them. And one of the first things I will say is have a very distinct process that you think AI will help you with and then explore that. And you can kind of play around with it a little bit beforehand if you want, but think through what you're doing and try to figure out what you want AI to help you make more efficient. And if you have a bunch of heterogeneous data, and you want something to be able to process that and make it into something else, if you've got a bunch of financial data or something like that, and you need to build out spreadsheets that go to clients or that track clients or something like that, that's great. That's a good use of it.
And it's not just some pie-in-the-sky, I want AI to do magic for me. And then on top of that, we'll look at that and say, okay, which kind of model, what sort of setup do you want? We're getting a better feel for which ones are good, which ones aren't so good. And we can sit down with them and say, okay, this is probably what you want and here's how you want to use it, because you can say, okay, I've got Claude, I've got ChatGPT. Well, you can have that in different iterations and different ways of doing it. And so we'll sit down with them and kind of figure that out. And then once we figure that out, we'll go through all the configuration items and work through there. And one of the things I do with a lot of our clients is in real time, work through that with them so that they see what's going on. And they'll have one point of contact that knows what's in there, the stuff changes. And so it's kind of like, if we look at it last month and we look at it this month, there's going to be new ways to do that. So we're always going through our own configuration and resetting some of those security settings and the connections and the tools that are in there. Because it's just changing so fast that we have to be a lot more aware of what's going on in there.
Kellams: What if I'm an owner of a small business, and really, I haven't been able to keep up personally with everything. And so an employee comes to me and says, oh, I'd like to add this. It will help us do this. All right. They've done the first step, which is to come to me and ask. And I go, I don't know.
Wright: That's what people like us are here for. We get those questions all the time. We have several dozen clients and I work very closely with about a dozen of them from a security standpoint. And as long as our clients will come to us and say, hey, we're interested in this. What is the implications of this? What's the risk here and stuff like that? I will give them all the time they want. My goal is to help them be secure. So if they show a little bit of motivation, they're going to get a whole lot more of my time than they probably even want. But they're going to come away knowing, hey, this has been picked through with a fine-tooth comb and we understand what's going on here. Chris has done his best to educate us and help us understand. And so, if a business owner finds out that, hey, my users want to try AI, but I am completely unknowledgeable about that because it's not really been a thing in my life, then that's what people like us are there for, to help them understand, help them find, okay, I think your employee is overestimating what it can do, or that's a great use case for it. So let's see if we can get that implemented efficiently and effectively.
Kellams: Should we just take advertising pitches or sales pitches about AI programs at face value?
Wright: Sorry, I laughed over you. You should never take a tech sales pitch as gospel. No. Especially AI. It's a lot of hype. There's a lot of stuff. If you've seen a lot of the mythos and fable from Claude, from Anthropic. And I'm a big Claude fan, so I like Claude. We've used that quite a bit, but there's a lot of smoke and mirrors there. There's a lot of marketing and that kind of stuff behind it. And it is probably the most extreme of the hype that I've seen from anywhere. And I can trace back 20 years going through and fishing through the hype of a brochure to show how a tool actually worked and how, if it was implemented as the brochure said, it would have crippled the entire United States Air Force.
Kellams: That's scary.
Wright: Yeah, I ran into that first in 2006, I think. And they were trying to build out some internet gateways just off the brochures and somebody thought, hey, we'll send this down to the Information Warfare Center. They've got labs down there and they can take a look at this. And we had to tell them, yeah, it doesn't do what the brochure says, so it only does about a third of that. So let's try to rework this so that we don't cripple anything. And they were good about that. And they said, yeah, okay, we understand.
Kellams: Anything else we should know about shadow AI?
Wright: It's probably in use. If you're a business owner, I can almost guarantee that at least one of your employees is using AI in some function. So it's probably a good idea to try to get the pulse of that in your company, figure out what people want to use it for, and start to build some guardrails around it, and have a sanctioned platform that you know of and you can control within your organization, before it gets too far out of hand.
Kellams: Chris, as always, thank you for your time.
Wright: Absolutely. Good to speak with you again, Kyle.
Kellams: Chris Wright is partner and lead security engineer at Little Rock-based Sullivan Wright Technologies. And he helps us better understand developments in business and personal computing. This is Ozarks at Large.
Ozarks at Large transcripts are created on a rush deadline and edited for length and clarity. Copy editors utilize AI tools to review work. KUAF does not publish content created by AI. Please reach out to kuafinfo@uark.edu to report an issue. The audio version is the authoritative record of KUAF programming.
