Generative artificial intelligence, where your employees happily copy source code to save time, is exactly the same technology that cybercriminals are exploiting.
This use of AI serves to improve or industrialize their attacks. This symmetry, which we could already see with pentest tools but to a lesser extent, is on the way to becoming one of the main cyber risks for 2026. However, a majority of organizations still struggle to see the link between these two realities.
Internally, the phenomenon now has a name: “Shadow AI”. The use of AI platforms not validated by the IT department ranks third among risky (non-malicious) behaviors in businesses according to the 2026 edition of the study Data Breach Investigations Report (DBIR) from Verizon Business. This practice has jumped 400% in one year. Externally, the threat is changing at the same pace: on a panel of users who requested generative AI for attack techniques, the requests focused on 15 different attack vectors on average. We are therefore faced with a double threat, boosted by a single technology, against which too few security teams are truly armed.
The end of borders: when the browser becomes the new vulnerability
With and since Covid, the democratization of teleworking has gradually diluted the traditional security perimeter, extending it from the office to the home or even to the local café. This constituted a real challenge to be dealt with quickly by the cyber security teams. But today, the front line has moved again. It is no longer located at the level of the laptop or the Wi-Fi network: it is played directly in the tab of a web browser or during a casual exchange between a colleague and a chatbot. This border is crossed every day at a speed that often renders any attempt at traditional governance obsolete.
The figures speak for themselves: almost half of employees (45%) regularly use AI as part of their job with their professional equipment, but using personal accounts (67%). This yawning chasm between the massive adoption of uses and the lack of IT control prepares the ground for the data leaks of tomorrow. Human error has changed in scale. Driven by a desire to do good, employees entrust these external systems with critical information (connection identifiers, sensitive customer data or industrial secrets). According to the DBIR, source code is at the top of the elements most recklessly shared with these public models. Faced with this invisible hemorrhage, simple charters of good conduct or the usual training modules may prove insufficient.
Rethinking architecture: from passive control to active vigilance
AI mechanically increases the attack surface of companies tenfold. To respond to this, the SASE (Secure Access Service Edge) approach is a technical obviousness by merging the network and security into a uniform, coherent architecture in line with the company’s business challenges. No more blind spots: SASE provides the centralized visibility essential to instantly react to suspicious behavior.
Most importantly, this architecture lays the foundation for a true Zero Trust strategy. As generative AI produces undetectable phishing campaigns and vividly realistic presidential fraud, trust can no longer be given by default. In a Zero Trust model, each request, each access is systematically authenticated and contextualized (identity, device compliance, geolocation but also a mature Data Loss Prevention (DLP) policy), regardless of where the request comes from. This is the only way to simultaneously neutralize the clumsiness linked to Shadow AI and complex external offensives while waiting for new forms of defense.
Ultimately, artificial intelligence acts as both a poison and its own antidote. Its potential for innovation and productivity is far too strategic to be simply banned. The challenge is therefore not to prohibit it, but to build a secure execution environment for it, where it can unleash its full potential without endangering the company’s intellectual property. The combination of SASE architecture and Zero Trust responds exactly to this challenge: it deploys invisible safeguards that protect without restricting performance. Intelligent, consistent guardrails, seamlessly applied to every worker, every device, and every query, no matter where the new frontiers of work take us.
