AI & Security
Your Team May Be Using AI Tools You Haven't Approved. Here's What to Do.
Security vendors are now selling tools to find unapproved AI use at work. A small business can get most of the protection with an approved list and a few plain rules.
By Kindloom Labs · October 13, 2026
What changed
On October 13, 2026, the security company Sophos made a product called AI Defense generally available. It is built to find the AI tools people at a company are using, including ones nobody approved, and to enforce rules on them. It can also check prompts and file uploads as they happen, to stop sensitive information from being sent to an AI tool. The industry term for this unapproved use is "shadow AI": staff signing up for a chatbot, a writing assistant or a browser extension on their own, often with good intentions, and feeding it work information the business never agreed to share.
The honest nuance
AI Defense is not aimed at a five-person shop. Sophos sells it as an add-on for customers of its business security products who have moved to its newer Fusion platform, so for most small businesses the product itself is not the point. The point is that a security vendor thinks the problem is common enough to build a product around it. You also do not need software to start dealing with it. Most shadow AI is not malicious. It happens because someone found a tool that saves them time and nobody told them which tools were fine to use or what should never go into one.
Why it matters for your business
When an employee pastes a customer list, a contract, payroll figures or a client's private details into a free AI tool, that information leaves your control. Depending on the tool's terms, it may be stored, reviewed by the provider or used to improve its models, and you may have promised customers or clients that you would not share it that way. A small business usually does not have an IT team watching for this, which makes clear expectations more important, not less. The goal is not to ban AI. It is to make the safe choice the easy one, so people keep the time savings without exposing information you are responsible for.
What to actually do
This week, ask your team which AI tools they actually use for work, and make it clear nobody is in trouble for the answer. From that list, pick one or two tools you are comfortable with, ideally business plans whose settings or terms say your data is not used for training, and write them down as the approved tools. Then write three short rules everyone can remember: no customer personal details, no passwords or account logins, and no financial or contract documents in any AI tool unless the approved tool's terms allow it and you have said so. Share the list and the rules in one message, and check back with the team in a month to see what has changed.
From Kindloom Labs
The rules above are easier to hand to a team when there is something to point at. The free Quick Read What Not to Paste Into AI covers the kinds of information that should stay out of AI chats and safer ways to still get help, which makes a good starting point for your own short policy.
Sources
Stay in the loop
Get notified about new releases, content, and blog updates from Kindloom. No spam, unsubscribe anytime.