AI is increasingly being compared to shadow IT, not because it is inherently reckless, but because it is being adopted faster than governance structures can keep up. This framing resonated strongly in recent discussions, including last week’s webinar, where there was broad agreement that AI is simply the latest wave of technology entering organizations through both sanctioned and unsanctioned paths.
What is surprising, however, is that some cybersecurity leaders believe AI should fall outside their responsibility. This mindset creates a dangerous gap. Historically, when new technologies emerged—cloud computing, SaaS platforms, mobile devices—security teams were eventually expected to step in, assess risk, and establish controls. AI is following the same trajectory.
From a practical standpoint, AI is still software. It runs on infrastructure, consumes data, integrates with applications, and influences business processes. If cybersecurity teams already have responsibility for securing software systems, data flows, and third-party tools, then AI naturally falls within that same scope. Treating it as an exception only delays accountability.
That said, AI is not just another application. While it shares many of the same risks as traditional software, it also introduces new dimensions that security and risk teams must recognize. Models can behave unpredictably, learn from biased data, or produce outcomes that are difficult to explain or audit.
One of the most significant shifts AI introduces is the prominence of ethics and automated decision-making. Unlike conventional software that follows explicit rules, AI systems can influence hiring decisions, credit approvals, medical recommendations, and security actions at scale. These outcomes can have real-world consequences that go beyond confidentiality, integrity, and availability.
Because of this, cybersecurity leadership must expand its lens. Traditional controls like access management, logging, and vulnerability management remain critical, but they must be complemented with governance around model use, data provenance, human oversight, and accountability for AI-driven decisions.
Ultimately, the debate is not about whether AI belongs to cybersecurity—it clearly does—but about how the function evolves to manage it responsibly. Ignoring AI or pushing it to another team risks repeating the same mistakes made with shadow IT in the past.
My perspective: AI really is shadow IT in its early phase—new, fast-moving, and business-driven—but that is precisely why cybersecurity and risk leaders must step in early. The organizations that succeed will be the ones that treat AI as software plus governance: securing it technically while also addressing ethics, transparency, and decision accountability. That combination turns AI from an unmanaged risk into a governed capability.
In a recent interview and accompanying essay, Anthropic CEO Dario Amodei warns that humanity is not prepared for the rapid evolution of artificial intelligence and the profound disruptions it could bring. He argues that existing social, political, and economic systems may lag behind the pace of AI advancements, creating a dangerous mismatch between capability and governance.
InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | AIMS Services | Security Risk Assessment Services | Mergers and Acquisition Security
At DISC InfoSec, we help organizations navigate this landscape by aligning AI risk management, governance, security, and compliance into a single, practical roadmap. Whether you are experimenting with AI or deploying it at scale, we help you choose and operationalize the right frameworks to reduce risk and build trust. Learn more at DISC InfoSec.
- AI Is the New Shadow IT: Why Cybersecurity Must Own AI Risk and Governance
- OWASP Top 10 Web Application Security Risks ↔ MITRE ATT&CK Mapping
- AI Model Risk Management: A Five-Stage Framework for Trust, Compliance, and Control
- Why ISO 42001 Matters: Governing Risk, Trust, and Accountability in AI Systems
- From Concept to Control: Why AI Boundaries, Accountability, and Responsibility Matter
