#NSBCS.128 - AI Governance and Shadow AI

Cyber Resilience
Written By Shane Bell
 

When AI Governance Creates Too Much Friction, Your Staff Will Work Around It

Shadow AI is not the real problem.

Invisible governance is.

Staff are already using AI tools at work, whether organisations officially approve them or not.

The real question is whether leaders have:

  • visibility

  • safe adoption pathways

  • practical governance

  • or simply the illusion of control.

A blanket ban on AI rarely stops adoption.

It usually drives it into Shadow AI workflows outside organisational visibility.

When staff feel governance creates friction or slows productivity, they will often bypass it entirely using personal accounts, unapproved tools or unsanctioned workflows.

That is where risk increases rapidly.

Not because staff are malicious, but because most organisations have not yet made safe AI adoption easy, practical or well understood.

Traditional governance models are struggling here.

Many organisations are still approaching AI governance with:

  • static policy documents

  • blanket restrictions

  • high-friction governance processes with lengthy approval cycles

  • compliance models focused more on control than enablement

But modern AI governance should not act as a brake on innovation.

It should act as the guardrail that allows organisations to move faster with confidence.

Good brakes on a car do not slow you down.

They allow you to drive faster safely.

The organisations succeeding with AI are shifting toward governance models focused on enablement that:

  • provide approved enterprise AI solutions

  • establish clear usage guardrails

  • define use cases tiered by risk

  • embed visibility and monitoring

  • educate staff on safe AI usage

  • teach staff how to sanitise sensitive or personal data before using AI tools

Because governance maturity is not achieved by saying:

“Do not use AI.”

It is achieved by creating environments where staff understand:

  • what is safe

  • what is risky

  • what requires escalation

  • and which tools are approved for use.

The organisations that succeed with AI will not necessarily be the ones with the strictest controls.

They will be the ones that make safe AI adoption easier than unsafe workarounds.

  • Microsoft Releases Record-Breaking June 2026 Patch Tuesday Addressing Over 200 Vulnerabilities - Microsoft has issued its largest-ever Patch Tuesday update, fixing approximately 200-208 security flaws across Windows, Office, Edge, Azure, and other products, including multiple critical vulnerabilities and several zero-days (with some publicly disclosed or actively exploited prior to patching). Notable issues include privilege escalations, BitLocker bypasses, and denial-of-service flaws. Google also released extensive Chrome updates addressing dozens of vulnerabilities, some under active exploitation. This unprecedented volume highlights the accelerating pace of vulnerability discovery and disclosure. Organisations should prioritise immediate patching, particularly in enterprise and critical infrastructure environments, and monitor for post-exploitation indicators.

  • Attackers Enhance Microsoft Teams Social Engineering with AI Voice Cloning - Security researchers have observed a rise in hybrid attacks that start with Microsoft Teams messages and escalate via AI-generated voice calls impersonating trusted colleagues, executives, or IT staff. These vishing techniques exploit default Teams settings and create short detection windows for credential harvesting, lateral movement, or fraud. AI tools now enable realistic voice cloning from limited audio samples, significantly lowering the barrier for sophisticated impersonation. Businesses are advised to implement strict callback verification on separate channels, review Teams configurations, and update awareness training to address these evolving social engineering risks.

  • CISA Adds Two Vulnerabilities to Known Exploited Catalog - CISA has added two new entries to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-42271 (BerriAI LiteLLM command injection) and CVE-2026-50751 (Check Point Security Gateway improper authentication). These reflect active exploitation in the wild, with remediation deadlines for federal agencies. The LiteLLM flaw poses risks to organisations using AI gateways/proxies, while the Check Point issue affects VPN authentication. Users should apply patches promptly, review access controls, and reduce exposure of management interfaces.

  • ShinyHunters Publishes DentaQuest Data Impacting 2.6 Million - The ShinyHunters group has leaked approximately 234 GB of sensitive data stolen from DentaQuest, a major US dental benefits administrator, following failed ransom negotiations. The breach, which occurred in May 2026, exposes information for around 2.6 million individuals including names, addresses, dates of birth, email addresses, phone numbers, government IDs, and health insurance details. DentaQuest confirmed unauthorised access to a limited portion of its network and stated the incident was contained. This incident reinforces the persistent threat of data extortion targeting healthcare and third-party providers.

  • Ongoing Threat Intelligence Highlights Patching Urgency and Emerging Risks - Recent reports underscore the need for rapid vulnerability management amid rising AI-augmented threats, supply chain risks, and exploitation of remote access tools. Organisations are encouraged to strengthen behavioural analytics, runtime monitoring, and third-party risk management.

References
Shane Bell
Next

#NSBCS.127 – A Quick Look at Recent Software Supply Chain Risks