Financial institutions that respond to shadow AI by blocking unapproved tools may be making their exposure worse, not better, according to John Denham of Napier AI.

In a recent analysis, Denham argues that restriction alone mistakes a demand problem for a technology problem, and in financial services that demand is here to stay.

Shadow AI, the use of unsanctioned AI tools by employees to get their work done, has become one of the more uncomfortable topics in information security. Napier AI points out that the sector is especially exposed because it combines relentless productivity pressure with tightly regulated data environments. Staff are turning to AI to accelerate reporting, compliance tasks, analysis and client communications, frequently moving faster than governance can keep up.

The scale is striking. Research cited by Napier AI found that more than 80% of workers, including nearly 90% of security professionals, use AI tools their employer has not sanctioned. Even the teams charged with enforcing controls are part of the trend.

Denham stresses that intent is usually good. Employees reach for public tools when secure, approved alternatives are missing or awkward to use. Yet the result can still be regulated or commercially sensitive data entering unmanaged systems. Given the strict audit, compliance and operational resilience duties financial firms carry, this becomes a regulatory risk rather than a mere IT nuisance.

Napier AI is clear that shadow AI is not simply shadow IT rebadged. Beyond unauthorised technology use, it introduces uncontrolled data exposure through prompts and outputs that may be wrong.

Source link