VentureBeat’s unique interview with Sam Evans, CISO of Clearwater Analytics, reveals why enterprise browsers are shortly turning into the frontline protection in opposition to shadow AI in its many varieties.
Evans confronted a vital problem in October 2023. Standing earlier than Clearwater Analytics’ board, he needed to confront issues that staff may inadvertently expose knowledge that might probably compromise the agency’s $8.8 trillion property below administration.
“The worst possible thing would be one of our employees taking customer data and putting it into an AI engine that we don’t manage,” Evans informed VentureBeat. “The employee not knowing any different or trying to solve a problem for a customer…that data helps train the model.”
Right here is our dialog with Evans, edited for size and readability
VentureBeat: How do you see AI shaping cybersecurity as we speak?
I like to elucidate it to our board, as the last word cat-and-mouse sport. As dangerous actors begin to use AI to advance phishing, or maybe expedite the time it takes for exploits to emerge after vulnerabilities are introduced, there’s the other facet of safety practitioners utilizing AI to assist advance how we reply.
VentureBeat: How is AI serving to your defensive capabilities?
Evans: We’ve begun integrating AI into our safety playbooks. By doing so, our safety analysts now spend much less time looking out and searching. The AI is concerned within the safety operations middle (SOC) product, conducting its preliminary triage evaluation and saying, “Based on previous things that we’ve seen and things in my model, this is where I’d like to guide you.”
On the defensive facet, we’re actually beginning to see AI come into play. CrowdStrike, Sentinel One, Microsoft Defender, the normal prolonged detection and response (EDR) merchandise had been utilizing some machine studying, and they’d get to a chance of perhaps 85% that this might be a menace, however we’re probably not positive. Nevertheless, AI enriches the EDR engine’s means to succeed in the next chance charge of figuring out a menace.
VentureBeat: What retains you up at evening in terms of AI and cybersecurity?
Evans: The factor that does fear me fairly a bit is the deepfakes. You learn a number of tales about folks utilizing deepfakes to impersonate a CEO to provoke wire transfers. These are regarding as a result of they do look very, very actual.
However the greatest concern? The worst potential factor could be one in all our staff taking buyer knowledge and placing it into an AI engine that we don’t handle, after which it turns into knowledge that helps prepare the mannequin.
VentureBeat: How did you clarify this shadow AI danger to your board?
Evans: I keep in mind when one of many first board conferences I used to be in, they requested me, “So what are your thoughts on ChatGPT?” I mentioned, “Well, it’s an incredible productivity tool. However, I don’t know how we could let our employees use it, because my biggest fear is somebody copies and pastes customer data into it, or our source code, which is our intellectual property.”
However I didn’t simply come to the board with my issues and issues. I mentioned, “Well, here’s my solution. I don’t want to stop people from being productive, but I also want to protect it.” After I got here to the board and defined how these enterprise browsers work, they’re like, “Okay, that makes much sense, but can you really do it?”
VentureBeat: Stroll me by means of your analysis and deployment course of for Island.
Evans: After that October 2023 board assembly, we began a reasonably lengthy due diligence course of. We took a have a look at among the main distributors within the enterprise browser house.
I’ll share with you finally why we went with an Island. We would have liked to have the ability to management what browsers individuals are utilizing on their endpoints. It doesn’t do any good to deploy an enterprise browser when any individual can go and obtain Opera or “Frank’s browser of the month” and use it, and it simply bypasses the entire Island controls.
The opposite cause we went with Island was really due to the velocity of the deployment. I keep in mind being on a name with Island salespeople, and so they’re saying, “We believe we can get this deployed in your company in a matter of weeks.” I’m like, “Oh, that’s BS.”
VentureBeat: However they delivered?
Evans: They took it as a private problem! We began our Island deployment in April 2024 with about 200 folks. We went the extension route first; the Island extension in Chrome and Edge.
It wasn’t till July when the board requested, “How is it going?” And I mentioned, “How about I just show you?” I pulled up a screenshot as a result of, you already know, Murphy’s Legislation demos all the time fail. So I confirmed them screenshots, “Here I am on ChatGPT. I tried to paste something in. I got the prompt: ‘Island policy prevents you from doing this.’”
They’re like, “Wow, this is fantastic! But people can still utilize the tool to ask good questions?” I mentioned, “Yeah, absolutely. They just can’t put data into it.”
VentureBeat: Do you are feeling that Island assures you and reduces the chance of Shadow AI?
Evans: It positively has helped us get a deal with on shadow AI. No safety software is 100% excellent. Having deployed Island, we positively sleep rather a lot simpler. We are able to really feel moderately snug that if an worker goes to an AI occasion that we don’t have licensed, they will use it, however can’t paste knowledge or add recordsdata.
It’s additionally helped us establish the place we’ve gaps. Staff discovered this actually nice AI widget factor, they arrive to the safety crew, “Hey, look, check this out.” After which we will come again to our product improvement groups and determine how we assist allow this, not only for our staff, however for our prospects.
VentureBeat: How do you defend in opposition to deepfakes?
Evans: That’s a troublesome one to wrap your arms round. We’ve got a superb safety consciousness program. We ask staff to make use of widespread sense. Do you actually suppose Sandeep Sahai, our CEO, goes to name you up and ask you to purchase him Apple reward playing cards?
We’ve arrange quite a lot of checks and balances, sort of just like the two-person buddy examine system. There’s no know-how resolution for one thing like that. It’s a human drawback that we’ve needed to implement a human resolution.
VentureBeat: What recommendation would you give different CISOs dealing with shadow AI?
Evans: This isn’t nearly blocking, it’s about enablement. Convey options, not simply issues. After I got here to the board, I didn’t simply spotlight the dangers; I proposed an answer that balanced safety with productiveness.
Welcome to the shadow AI arms race
Evans’ insights reveal how shortly shadow AI has turn into an existential menace to each data-intensive enterprise.
“We see 50 new AI apps a day, and we’ve already cataloged over 12,000,” Itamar Golan, CEO of Immediate Safety, informed VentureBeat, quantifying what safety groups are calling their worst nightmare since ransomware.
The onslaught of unauthorized AI use and apps has triggered intense competitors amongst safety distributors. “Most traditional management tools lack comprehensive visibility into AI apps,” Vineet Arora, CTO of WinWire, defined to VentureBeat, pinpointing precisely why shadow AI prospers as legacy safety architectures are blind to it.
The seller ecosystem has crystallized into 4 distinct battlegrounds, every with its weapons and weaknesses.
Enterprise browsers lead the cost. Foremost amongst them is Island, which just lately raised a $250 million funding spherical, a vote of confidence from the investor neighborhood. Whereas Island bets on pre-encryption visibility, Google Chrome Enterprise assaults shadow AI in another way, weaponizing its market dominance and Google’s safety stack. Chrome Enterprise Premium delivers knowledge loss prevention (DLP) controls that block knowledge flows to ChatGPT and different AI instruments, forestall cross-profile contamination and implement real-time content material scanning. The platform exposes shadow AI utilization patterns whereas blocking each unintended pastes and deliberate exfiltration. Strategic partnerships with Zscaler and Cisco Safe Entry amplify Chrome’s attain to create an ecosystem the place zero-trust ideas lengthen on to AI interactions.
SASE/SSE platforms ship enterprise-scale protection. Netskope and Zscaler carry scale to shadow AI protection by means of their cloud-native safety entry service edge (SASE) architectures. Each platforms course of billions of transactions every day throughout world infrastructures, with Netskope particularly promoting its means to observe AI software utilization throughout enterprises. Their key limitation: When 73.8% of office ChatGPT utilization happens by means of private accounts, SSL/TLS encryption prevents platforms from inspecting content material, forcing them to depend on site visitors patterns and metadata, resulting in visibility gaps the place shadow AI operates undetected.
Conventional DLP distributors wrestle to adapt. Legacy distributors Forcepoint and Microsoft Purview have a powerful legacy to commerce on in terms of battling shadow AI. Forcepoint claims 1,700-plus classifiers whereas Purview leverages AI to triage duties. However right here’s the issue: They’re retrofitting Twentieth-century architectures for Twenty first-century threats. These platforms excel at compliance checkboxes and coverage templates however fail to maintain up with AI’s faster tempo.
As Daren Goeson, Ivanti’s SVP of product administration for UEM informed VentureBeat: “AI-powered endpoint security tools can analyze vast amounts of data to detect anomalies and predict potential threats faster and more accurately than any human analyst.” Conventional DLP operates at audit velocity. Shadow AI strikes at machine velocity.
Specialised options fill vital gaps. Innovation thrives within the niches that legacy distributors ignore. One instance is Ivanti Neurons, which delivers complete system discovery by means of its UEM platform, exposing shadow AI hiding in endpoints that conventional instruments miss. Mike Riemer, Ivanti’s Subject CISO, sees the larger image: “Security professionals will effectively leverage the capabilities of gen AI to analyze vast amounts of data collected from diverse systems.” Dusk, for its half, targets developer groups with transformer fashions, claiming 2x detection accuracy for API based mostly AI instruments.
Evaluating Shadow AI Protection Options
VentureBeat evaluation
What’s driving the market to maneuver so quick? VentureBeat’s evaluation discovered 74,500-plus shadow AI apps actively deployed throughout main consulting corporations alone, and that’s rising 5% month-to-month. By mid-2026, that quantity may hit 160,000. Every represents a possible knowledge breach, compliance violation, or aggressive intelligence leak.
Arora’s prescription cuts by means of vendor hype: “Organizations must define strategies with robust security while enabling employees to use AI technologies effectively. Total bans often drive AI use underground, which only magnifies the risks.”
Day by day insights on enterprise use circumstances with VB Day by day
If you wish to impress your boss, VB Day by day has you coated. We provide the inside scoop on what firms are doing with generative AI, from regulatory shifts to sensible deployments, so you may share insights for optimum ROI.
An error occured.
