Ram Varadarajan, CEO at Acalvio, comments, “Many small businesses now spend hours each week having employees proofread artificial intelligence, a habit that catches clumsy answers but reveals little about where an automated agent has been or what it has touched. And the more capable the models become, the more polished their outputs look. 

“Security practitioners who know the problem know that behavior is the better signal, and our best approach is to seed a company’s systems with decoy files and credentials that no legitimate employee or program would have reason to open, so that any contact with them is an immediate warning. 

“Before deploying another agent, businesses should limit what it can reach, set out those AI-baiting traps, and ask their technology providers about what’s monitoring the environment while everyone’s busy watching the chatbot.”

The report also shows these organizations are experiencing pressure to build and implement AI, with 66% of SMBs stating their business will not be competitive in the next three years without it. 

Aviv Nahum, Co-founder and CEO at Above Security, adds, “The most interesting finding here isn’t simply that employees are using unauthorized AI. It’s that small businesses are now building agents and workflows that connect AI directly into the systems where the business actually runs. That turns shadow AI from a software-governance problem into a business-process and security problem.

“An employee experimenting with a chatbot is one level of risk. An employee building an agent that has credentials, accesses company data, connects to finance or CRM systems, and performs multi-step work autonomously is something very different. At that point, the organization has effectively created a new insider, often without a clear owner or a security team even knowing it exists.

“The answer should not be to slow AI adoption or block employees from experimenting. The data actually shows that businesses getting the most value from AI are the ones deploying it more broadly. The security challenge is making that deployment visible and accountable: know what agents and workflows exist, who owns them, what data and credentials they can access, and whether their behavior continues to make sense once they are running.

“Policies alone are not enough. A company can have an AI policy and still have no idea what an internally built agent is doing after deployment. Security teams need continuous visibility into behavior and data movement, especially as AI shifts from generating content to taking actions on behalf of employees.”