TL;DR
Shadow IT and Shadow AI are now leading causes of internal security incidents.
Employees adopt unapproved tools, including AI, faster than organizations can evaluate them, and the result is donor data, financial records, and staff information ending up in places you never authorized. The fix isn’t a massive IT budget: it’s clear policies, regular training, and a culture where staff know how to ask before they act.
What Is Shadow IT and Shadow AI?
Shadow IT refers to any technology used without IT approval. This includes obvious examples like connecting a personal device to your network, but also everyday decisions your staff may not think twice about: using a personal Gmail account to share ministry files, adopting a free project management app because it’s easier than asking IT, or signing up for a cloud storage service to collaborate with a volunteer.
Shadow AI is a rapidly growing subset of Shadow IT. It happens when staff use AI tools, often free, consumer-grade ones, for work tasks without authorization. A staff member might paste donor names and giving amounts into ChatGPT to draft thank-you letters. A volunteer coordinator might upload a contact spreadsheet to an AI tool to “clean up the formatting.” A finance employee might summarize grant documents in a free AI assistant, unaware the platform’s terms allow it to use uploaded content for model training.
None of these people are trying to cause harm. But the data they’re exposing is real.
This Isn't Just a Big-Organization Problem
It’s easy to assume that high-profile breaches only happen to large companies. But the risk scales down. In 2023, Samsung engineers were reported to have shared proprietary chip design data with ChatGPT, a cautionary example that made headlines. Your organization may not make headlines, but donor records, employee information, and financial data are just as valuable to bad actors, and just as easy to expose through an unvetted tool.
Why Does This Happen?
The most common reason is speed. Employees find tools that help them work faster and adopt them before IT has a chance to evaluate them. There’s rarely malicious intent, just a gap between what’s available and what’s been approved.
Before assuming your organization is covered, ask:
- Do we have an AI policy that tells staff which tools are approved and how to request an exception?
- Have we communicated that policy clearly, not just posted it somewhere, but trained on it?
- Do we have a BYOD policy, and can we protect data if a personal device is lost or stolen?
If any of those answers are uncertain, you likely have a gap worth closing.
What You Can Do
Protecting your organization doesn’t require a large IT budget: it requires clear policies, consistent communication, and a few practical controls.
Start with policy. If you don’t have a written AI policy yet, that’s your first step. It doesn’t need to be long, it needs to tell staff what’s approved, what isn’t, and how to ask for an exception. Download this sample policy to start with.
Train your staff, at minimum, annually. Policies don’t protect you if people don’t know about them. Include real examples your team will recognize, not just abstract warnings. Ask us about training we offer for your team.
Audit what’s in use. You can’t govern what you don’t know exists. Regular technology audits, even a simple annual inventory of what tools staff are actively using, help surface unauthorized applications before they become a liability.
Test your team with a phishing simulator. Phishing remains the most common entry point for external threats. A simulator sends realistic test emails and shows you who clicks, so you can coach before a real attack happens. Side note, CIM offers a phishing simulator to test your staff.
Enforce BYOD boundaries. If staff use personal devices for work, require mobile device management (MDM). This lets you enforce which apps can access ministry data and remotely wipe a device if it’s lost or stolen.
Involve the right people. Shadow IT risk isn’t just an IT problem, it touches finance, HR, communications, and leadership. Where possible, involve staff from across the organization when evaluating new tools. A broader set of eyes catches more issues, distributes work, and builds organizational buy-in for the policies you’re trying to enforce.
The Stewardship Angle
Your donors, volunteers, and staff trust you with their information. Shadow IT and Shadow AI aren’t just IT problems, they’re stewardship problems. The good news is that closing the gap doesn’t require perfection. It requires intention.
If you’re not sure where your organization stands, we’d welcome the conversation. Contact us to talk through a simple assessment — no pressure, just a starting point.