Enterprise Data
Shadow AI is a data inventory problem, not a discipline problem
Employees paste company data into whichever assistant is fastest. Blocking the popular ones moves the behaviour rather than stopping it. What actually reduces exposure.
Updated 6 min readqikfox
The short answer
Unapproved AI use inside companies is driven by convenience, not defiance, so policy and blocklists move it to tools nobody can see rather than removing it. The measures that reduce exposure are a usable approved option, an inventory of where sensitive data actually lives, and controls at the point data leaves rather than at the point a tool is chosen.
Key points
- People route around a control that costs them time, and they do it quietly.
- Blocking known domains pushes usage to personal devices and unknown tools.
- Most leaked material is pasted text, not exfiltrated files.
- An approved tool that is slower than the unapproved one will not be used.
The pattern is consistent across organisations
Someone has a document to summarise, a contract clause to interpret or a stack trace to explain, and the fastest route is an assistant that is already open in a tab. The material goes in because the task is real and the deadline is today.
Nothing about that decision is malicious, and framing it as a training failure guarantees the same outcome next quarter. The person is optimising for the work they were hired to do.
Why blocking makes visibility worse
Network level blocks catch the handful of well known destinations and nothing else. New assistants launch continually, many are embedded inside tools that are already approved, and a phone on a mobile network is outside the perimeter entirely.
The result is not less usage. It is usage you can no longer see, on devices you do not manage, with no record of what was shared.
What reduces exposure in practice
Start from the data rather than the tool. Know which stores hold regulated or commercially sensitive material, who can reach them, and what leaves them. That inventory is useful for every other security question as well.
- Provide an approved assistant that is at least as fast as the alternatives.
- Classify a small number of categories properly rather than everything vaguely.
- Apply controls where data exits: uploads, clipboard in managed contexts, and outbound destinations.
- Log approved usage so patterns are visible instead of inferred.
- Say clearly which categories must never be pasted anywhere, and keep that list short enough to remember.
Ask the retention question in writing
For any assistant you approve, get written answers on what is retained, for how long, whether it is used for training, who inside the vendor can read it, and what happens on deletion. Marketing pages routinely answer these differently from contracts.
Where the answers are unsatisfactory and the tool is still needed, the fallback is to reduce what is sent. Redaction and synthetic examples are unglamorous and they work.
Questions and answers
Related qikfox pages
Data residency as architecture
Where processed data actually goes.
Security at qikfox
How we approach protection.
Security Center
Advisories and notices.
Contact qikfox
Reach the right team.
Back to The Perspective · Written and reviewed by the qikfox editorial team. Published .
Put the advice into practice
qikfox Safe Browser applies most of what this article describes by default, and works alongside qikfox Search, Antivirus and VPN.