How to manage the security risks of generative AI tools

Over the past year, we’ve witnessed an explosive growth spurt in consumer-focused AI productivity tools that has once again transformed the way we work. Once the realm of data science and engineering teams, generative AI was packaged and delivered to the masses in 2023.

Now, just over a year after the splashy arrival of ChatGPT, artificial intelligence is almost imperceptibly woven into the daily rhythms of modern work.

For context, SaaS security and governance provider Nudge Security has discovered over 500 unique generative AI applications in customer environments to date, up from 300 in November of 2023 and 150 in July of 2023.

Given this pace of adoption and the rapid introduction of new AI tools, IT and security teams are struggling just to gain an understanding of who’s even using GenAI tools in their organizations.

And because many of these AI tools have embraced the SaaS go-to-market model with free tiers and trials, there’s little barrier to entry, and no way of discovering usage through procurement or expense reports.

How can organizations mitigate these risks?

As is often the case, you have two options for managing the risks of GenAI tools. You can try to block all access, or you can offer ways for employees to experiment with these tools, with visibility and guidance from IT & security teams.

User behavior research shows that blocking access can often motivate employees to look for ways around security controls, ultimately undermining IT governance efforts. And, in order to block a particular tool, you typically need to know it exists in the first place, which is a challenge given that new GenAI tools are popping up almost daily.

How Nudge Security can help

Nudge Security is a SaaS management platform that discovers all SaaS accounts ever created by anyone in your organization, including GenAI tools. Within minutes of starting a free trial, you’ll have a continuously updated inventory of your AI footprint.

As new AI apps are introduced, Nudge Security alerts admins, providing visibility into who’s using what, and allowing you to guide employees towards best practices to mitigate AI security risks.

With Nudge Security, you can:

• Discover and inventory the AI tools your employees are using
• Get alerted when new AI tools are introduced
• Accelerate security reviews to evaluate unfamiliar tools
• Detect overly permissive OAuth scopes that could endanger corporate data
• Nudge employees towards approved providers and better security practices
• Share acceptable use guidance and collect policy acknowledgement

1. Gain immediate visibility of your GenAI footprint

If they’re anything like other workers, your employees are already using AI in the workplace—but they may not want to admit it. To understand the role AI tools play for your organization, you need to know what’s already out there and stay on top of new tools as employees sign up for them.

With Nudge Security, you can get an immediate inventory of all the AI tools your employees are using, and set up alerts to notify you when a new AI tool is introduced.

Nudge Security automatically discovers AI tools and other SaaS applications in your environment, and categorizes them by type for easy filtering, including the free, paid, and trial accounts that you might not be able to discover by relying on procurement processes or combing through expense reports.

2. Assess AI tools with context on usage and security

Nudge Security provides a summary view of each application to help you assess new AI tools quickly. You can see a short description of the app, find out how many accounts and integrations have been created by members of your organization, identify the original user, and check your users’ security hygiene.

Drilling into each tab in the menu provides even more information to support your evaluations.

For each app, Nudge Security also provides security context that can help you evaluate new applications quickly and systematically, such as links to their terms of service and privacy policies, an overview of their security program, supported authentication methods, and more.

For each vendor you’ll also see their breach history and get alerted of security incidents affecting the applications your employees are using so you can intervene swiftly to secure their accounts, integrations, and data.

As you complete vendor security reviews, you can set a status for each application to “Approved”, “Acceptable” or “Unacceptable” and share an Application Directory with employees so they can choose from approved options.

4. Surface and review risky OAuth grants

The ease of agreeing to an OAuth grant can entice users to hand over more access to GenAI tools than they might realize.

That’s why Nudge Security reveals the scopes each application has been granted and provides OAuth risk scores to help you identify risky OAuth grants quickly.

You’ll have the context you need to help you understand exactly what access and permissions each user has granted and what it means for your organization, so you can intervene if an application has too much access.

5. Provide timely acceptable use guidance

Given the viral spread of AI tools, you have the best chance of influencing users’ behavior by reaching them immediately when they sign up for a new app.

Nudge Security offers just-in-time interventions called “nudges”, so you can reach users immediately via email or Slack when they create a new account.

As soon as a user signs up for an AI tool, you can nudge them to review and acknowledge your AI acceptable use policy, reaching them right when the information is most relevant and useful.

Users can accept the policy directly from the nudge (and all responses are gathered to document acknowledgement of the acceptable use policy), or they can request help if they have questions.

You can also nudge them toward using an alternative application that you’ve already vetted, or prompt them to take a more secure action like setting up multi-factor authentication.

Fuel innovation while mitigating risks with Nudge Security

Your business needs AI to be competitive, which means your users need help determining which GenAI tools are trustworthy and how to use them in a way that does not put corporate data at risk.

Nudge Security helps you discover, secure and govern AI usage so you can assess the security of new tools efficiently and nudge your users towards secure practices.

Learn more about how you can manage AI security risks with Nudge Security and start a 14-day trial.

Sponsored and written by NudgeSecurity.