How to Get Breached, Step 5: Paste Client Data Into Any AI

Shadow AI is likely already in your office

Welcome to Week 5 of “How to Get Breached,” the series where we give you terrible advice so you can do the opposite.

This week’s tip is a time saver. Let every employee paste contracts, customer lists, and spreadsheets into whatever free AI tool looks helpful. No approval, no policy, no questions. Your data will be handled with all the care a stranger’s free website can offer.

If you own a business, the joke lands close to home. Your team is probably already doing a version of this.

What Shadow AI Looks Like

Shadow AI is any AI tool your staff uses for work that the business has not reviewed or approved. It usually shows up in three ways:

• Personal AI accounts used for business tasks, outside your control and your records.
• AI tools connected to company email, calendars, or files with a single click, with no one in IT approving it.
• AI reading mailboxes and documents that were never meant to be shared with it.

Nobody is acting maliciously. People are trying to work faster. The problem is that the data leaves your environment, and you cannot protect or retrieve what you do not know about.

A Hypothetical Example

Picture a 25-person company. An office manager wants a vendor contract summarized and a customer pricing sheet cleaned up. She opens her personal AI account and pastes both in. It works well, so she connects the assistant to her work mailbox to sort the inbox.

No one approved it. The owner learns about it months later, by accident. Now contracts, pricing, and customer emails sit in an account the company does not control, under terms no one read. When she leaves, the account goes with her.

Nothing dramatic happened. That is the point. This kind of exposure is quiet.

What To Do Instead

For the owner and IT team:

1. Define off-limits data. Customer personal information, financial records, credentials, and contracts should not go into unapproved tools.
2. Write a short AI acceptable use policy. One or two pages is enough. Say what is allowed, what is not, and who to ask.
3. Choose approved tools on purpose. Look for business-tier plans with admin controls, single sign-on and multifactor authentication, activity logging, and clear written terms on how your data is stored and whether it is used for training. Terms differ by vendor and plan, so read them.
4. Take inventory. Ask staff what they already use. Make it safe to answer honestly.
5. Control integrations. Limit who can grant third-party apps access to company email and files, so an AI connector needs admin approval.
6. Filter at the network level. DNS filtering can block or flag AI services you have not approved.
7. Monitor for unusual activity. Endpoint and log monitoring helps you notice what policy alone will miss.
8. Train people and update offboarding. Staff should know the rules, and departing employees should lose access to every tool tied to company data.
9. Review quarterly. New AI tools appear constantly.

Questions Your Clients May Ask

Are you putting my information into AI tools?
A good answer is: “We only use approved tools under a written policy, and client data is handled according to that policy.”

Can your team use AI at all?
Yes, with guardrails. The goal is safe use of AI, not a ban. A ban tends to push usage out of sight.

What happens if something is exposed?
You should have an incident response plan that covers AI tools and a clear process for notifying affected parties.

How Farmhouse Networking Can Help

We are vendor neutral. We do not resell AI tools. We advise on which fit your business and configure them securely. We can:

• Create AI acceptable use and data-handling policies written for your team.
• Set up DNS filtering to block or flag unapproved AI services.
• Use event log monitoring to help surface unusual activity.
• Review your tools against the CIS Controls to find gaps.

Ask for a Free Breach-Readiness Review

Not sure what your team is already pasting into AI? Email support@farmhousenetworking.com to request a free breach-readiness review. It includes a policy review, basic penetration testing, and a network inventory, with written deliverables in about one week.

Next week: How to Get Breached, Step 6: Share Files However Is Fastest.