Prove the Source: Fake Logins & Shadow AI Risk

Weeks two and three covered who's contacting you and what they're asking for. This week is about the surfaces you interact with directly, login screens, and AI tools, because both can now convincingly fake being trustworthy. This is increased if you are not managing your shadow AI risk.

A “sign in with Microsoft” window with the right padlock and the right address can be a picture of one, drawn inside an attacker's page rather than a real browser window. Checking for the padlock no longer proves anything. The same erosion of trust applies to AI tools: 43% of workers have put sensitive work information into one without their employer knowing, and over half have had no training on the risks at all. A prompt is a disclosure, paste in a customer list, a contract or staff data, and you've shared it with a third party that may store or reuse it, approved or not.

Both have the same fix: don't trust a surface just because it appeared. Don't sign in through a window that opened because you clicked something, open a new tab and go to the service yourself; a real sign-in window can be dragged outside the browser frame, a fake one can't. And before you paste anything into an AI tool, ask whether you'd be comfortable emailing that same content to a supplier you've never assessed. If the answer's no, don't paste it, and ask if you're not sure what's approved.

Read more on our site: Third-Party Risk Management: The Threat You Might Be Overlooking.

Talk to us: shadow AI use is a governance gap most organisations haven't measured yet. Try our free security & privacy assessments, or see our full AI Governance service.

Get the guide: the full CAM26 “Prove It” pack is free to download. Get the CAM26 guide.