[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdt7nvblYzinMdv2vq9o9sMiCQcPOa2dkpZIUYh8SFZs":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"31267755-3976-496f-9a69-71d700f8f8ba","NCSC Warns Shadow AI Is Creating New Security Blind Spots for UK Businesses","ncsc-warns-shadow-ai-is-creating-new-security-blind-spots-for-uk-businesses-93ce26","The UK’s National Cyber Security Centre (NCSC) has warned organisations about the security risks posed by “shadow AI”, as employees continue to turn to artificial intelligence tools that have not been approved by their employers. In guidance published this week, the NCSC described shadow AI as the use of AI technology outside an organisation’s approved […] The post NCSC Warns Shadow AI Is Creating New Security Blind Spots for UK Businesses appeared first on IT Security Guru.","The UK's National Cyber Security Centre (NCSC) has issued a warning about 'shadow AI,' the use of unapproved artificial intelligence tools by employees. This practice creates significant security blind spots, exposing sensitive data and reducing organizational control. The NCSC advises against outright bans, instead recommending improved visibility, secure integration, and addressing employee needs to mitigate risks.","NCSC warns UK businesses about security risks from unapproved 'shadow AI' tools used by employees.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F09\u002F09\u002Fncsc-warns-shadow-ai-is-creating-new-security-blind-spots-for-uk-businesses\u002F?utm_source=rss&utm_medium=rss&utm_campaign=ncsc-warns-shadow-ai-is-creating-new-security-blind-spots-for-uk-businesses","https:\u002F\u002Fwww.itsecurityguru.org\u002Fwp-content\u002Fuploads\u002F2019\u002F02\u002FNCSC.jpg","2026-09-09T14:50:52+00:00","2026-09-09T16:00:36.862173+00:00",7,[17,20,22,24,26,29],{"name":18,"type":19},"NCSC","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":19},"Keeper Security",{"name":25,"type":19},"CyberSmart",{"name":27,"type":28},"AI agents","technology",{"name":30,"type":28},"generative AI","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":31,"icon":33,"name":34,"slug":35},null,"AI Security","ai-security",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"23e81061-ab06-449f-8807-cbe4bc305045","UK Data Protection","uk-data-protection",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18,23],{"controls":57,"vendors":141},[58,84,113],{"slug":59,"name":60,"problem":61,"products":62},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[63,71,78],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":73,"url":76,"description":77},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":79,"product_name":80,"url":82,"description":83},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"slug":85,"name":86,"problem":87,"products":88},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":35,"name":114,"problem":115,"products":116},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":159},"shadow-ai-tools-creating-invisible-risk-in-uk-workplaces","Shadow AI Tools Creating Invisible Risk in UK Workplaces","Employees are increasingly adopting unapproved AI tools to boost productivity, bypassing IT governance and security review processes entirely. This 'shadow AI' behaviour means sensitive corporate and customer data may be processed by third-party services with unknown data retention, privacy, or security standards. Organisations lose visibility into what data leaves their environment, creating compliance exposure under frameworks like GDPR. The NCSC's warning highlights that outright bans are ineffective — cultural and procedural solutions are needed alongside technical controls.",[147,148,149,150,151,152,153,154,155,156,157,158],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 AC-4 – Information Flow Enforcement","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 SI-12 – Information Management and Retention","NIST AI RMF – Govern 1.1, Map 1.5","GDPR Article 5 – Principles of Data Processing","GDPR Article 25 – Data Protection by Design and by Default","GDPR Article 28 – Processor Agreements","NCSC Shadow AI Guidance 2024","ISO\u002FIEC 27001:2022 – A.8.4 Access to Source Code \u002F A.5.10 Acceptable Use of Information",{}]