A WatchGuard survey of 684 SMB employees across the US, UK, Germany, France and Spain found 64% use unauthorized AI tools at work, and fewer than 3 in 10 employers can accurately track what software staff actually run.
Why It Matters
This is not a US problem. Germany, France and Spain were in the same sample, and nearly 40% of the companies surveyed admitted they have no full visibility into which apps their own staff use. If employees are pasting client data into AI tools nobody vetted, there is no audit trail for exactly the kind of processing the EU AI Act's transparency duties and GDPR expect you to account for.
What To Do About It
Pull a week of firewall or DNS logs and check for traffic to AI tool domains your team was never issued (ChatGPT, Gemini, DeepSeek, or a Copilot Studio agent nobody registered). If you cannot produce that list in fifteen minutes, the visibility gap is the finding, not whatever tool turns up.
Sources
Related Signals
Microsoft cut AI agent security out of standard Defender licenses on 1 July.
30 Jul 2026
CoreView's July 2026 governance report finds two-thirds of organizations have delayed or cancelled Microsoft Copilot rollouts over fear it will surface overshared SharePoint files.
29 Jul 2026Um relatório da CoreView de julho de 2026 indica que dois terços das organizações adiaram ou cancelaram o Microsoft Copilot com receio de que exponha ficheiros partilhados em excesso no SharePoint.
29 Jul 2026