Topic starter
12/06/2026 12:01 am
TL;DR: A survey of 500 Australian technology decision makers found that 36% of employees upload sensitive company information to AI tools, while 70% of organisations have little to no visibility into what tools are being used and 63% of users lack confidence in secure use, according to Josys. The governance failure is not AI adoption itself, but the absence of visibility, policy enforcement, and audit-ready controls.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “New Report Reveals That Over 1/3 of Australian Professionals Expose Sensitive Company Data to AI Platforms”.
By the numbers:
- Over a third (36%) of employees upload sensitive company information to AI tools.
- 70% of organisations have little to no visibility into what AI tools are actually being used.
- 63% of users lack confidence in using AI securely.
Key questions
Q: What breaks when employees use shadow AI for work tasks?
A: Shadow AI breaks identity visibility and lifecycle control.
Q: Why does shadow AI create compliance and accountability gaps for organisations?
A: Shadow AI breaks the link between business activity, policy approval, and audit evidence.
Q: How can organisations tell whether AI governance is actually working?
A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.
Practitioner guidance
- Establish AI usage discovery Identify which AI platforms employees are actually using across browsers, devices, and managed SaaS estates, then reconcile that list against approved applications and procurement records.
- Classify data before disclosure Map sensitive data types such as customer PII, financials, strategy documents, and legal material to explicit handling rules before users can submit them to AI tools.
- Enforce role-based AI policy Tie policy decisions to role, business function, and sensitivity tier so that finance, healthcare, sales, and technical users do not share under the same rule set.
Bottom line: Shadow AI turns everyday productivity behaviour into an unmanaged disclosure path when employees move sensitive data into tools outside organisational control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 8:59 am
Shadow AI is no longer just an acceptable-use problem. It is an identity governance problem because the user is still authenticated, but the destination platform sits outside the organisation's approved control plane. Once that happens, access reviews, policy enforcement, and audit evidence no longer describe the full data path. Practitioners should treat unmanaged AI use as a governed access domain, not a fringe productivity behaviour.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do when AI tools appear outside approved channels?
A: Treat the finding as a governance exception, not just a procurement issue. Determine which users, data types, and business units are affected, then bring discovery, policy, and logging into a single control process before the behaviour becomes routine.
👉 Read our full editorial: Shadow AI governance gaps expose sensitive data at scale in Australia
This post was modified 1 day ago by NHI Mgmt Group