- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Across Indian boardrooms in 2025 and into 2026, a new security conversation has emerged alongside the excitement about generative AI productivity gains. Enterprise employees are using ChatGPT, Gemini, Copilot, and dozens of other AI tools to draft contracts, summarise board presentations, analyse competitor data, and write code — often without IT’s knowledge, without approved procurement, and without any data classification review. Security teams are calling this phenomenon Shadow AI, and it has quietly become one of the most significant insider risk vectors in the Indian enterprise landscape today.
This is not a theoretical risk. When a finance analyst pastes a vendor contract into a public LLM to get a quick summary, confidential commercial terms leave the organisation. When a developer uses an AI coding assistant that trains on submitted code snippets, proprietary source code exits the perimeter. When HR shares a spreadsheet of employee performance ratings with an AI tool to generate appraisal narratives, sensitive personal data subject to India’s Digital Personal Data Protection (DPDP) Act, 2023, is processed by an unauthorised third-party system. None of these employees intended harm — yet the risk is identical to a deliberate data exfiltration event from a regulatory and reputational standpoint.
Traditional insider threat detection relied on watching for anomalous bulk data downloads, after-hours access to sensitive directories, or USB device use. Shadow AI breaks this model in three ways:
The result is a category of data loss that sits in a blind spot between DLP, UEBA, and network monitoring — unless those tools are specifically tuned for GenAI traffic patterns.
India’s DPDP Act creates direct liability for data fiduciaries when personal data is processed without a valid legal basis or shared with unauthorised data processors. A third-party AI platform that an employee uses without an approved vendor agreement is, by definition, an unauthorised data processor. If that platform subsequently experiences a breach involving the Indian organisation’s data, the organisation may face DPDP enforcement action — even though the root cause was an employee’s productivity tool choice.
Under CERT-In’s 2022 directions, significant data breaches must be reported within six hours of detection. An organisation that discovers its confidential data has been processed by an unapproved GenAI service may trigger this reporting obligation, compressed into an already difficult incident response window.
This regulatory overlap — DPDP liability for unauthorised processing and CERT-In reporting obligations for breaches — means that Shadow AI governance is no longer purely an IT security concern. It is a board-level compliance risk.
Before you can govern Shadow AI, you need to see it. This requires SSL inspection on your network edge — FortiGate NGFWs support full SSL/TLS inspection with certificate management — combined with URL category filtering that classifies AI service endpoints. Run a discovery period of two to four weeks and build a baseline. You will almost certainly find tools that neither IT nor procurement was aware of. Common surprises include AI writing assistants embedded in browser extensions, AI features within productivity suites like Microsoft 365 Copilot activated at the tenant level, and direct API integrations built by developers bypassing the approved toolchain.
A blanket block on all GenAI services is politically unworkable in most Indian enterprises today — line-of-business leaders will push back, and employees will find workarounds using mobile hotspots. A more durable approach is data-centric: identify what data must never leave the organisation (personal data under DPDP, confidential contracts, source code, financial forecasts) and enforce controls specifically around that data. FortiGate DLP profiles can scan outbound content for patterns like PAN numbers, Aadhaar references, SWIFT codes, and proprietary document markers before content reaches any external endpoint.
Create a fast-track vendor assessment process specifically for AI tools. Assess each tool on data residency (is the processing in India or at least not in a jurisdiction incompatible with DPDP?), training data policies (does the vendor train on submitted content?), data retention (how long does the vendor store prompts?), and security certifications. Publish an approved list and communicate it widely. The goal is to reduce the friction of using approved tools to below the friction of using unapproved ones.
Even with URL filtering and DLP, detection of anomalous behaviour remains critical. A marketing executive who suddenly starts uploading large volumes of content to an AI service at 11 PM should trigger an alert even if the AI service is on your approved list. UEBA correlation — comparing the user’s current behaviour against their own historical baseline and against peer group norms — catches this category of risk that purely policy-based controls miss.
Regulatory frameworks and technical controls address the symptom. The cause is a knowledge gap: most employees using GenAI tools have never considered what happens to the data they submit. A 30-minute mandatory training module explaining DPDP obligations, the approved tool process, and real examples of GenAI data loss incidents (using anonymised or public cases) dramatically reduces inadvertent risk. Security awareness is not a checkbox — when done well, it turns employees into a detection layer.
Detecting and responding to Shadow AI risk across a distributed Indian enterprise requires correlation across network telemetry, user behaviour, log data, and physical access patterns. This is exactly the operational problem that PrahiX Ora, developed by PrahiX Tech Pvt Ltd, is built to address. PJ Networks deploys and operates Ora for clients as a unified SecOps platform — here is how each pillar of the platform contributes to this use case.
PrahiX Ora’s SIEM capability ingests log and event data from firewalls, proxy servers, endpoint agents, cloud access security brokers (CASBs), and identity providers into a single correlation engine. Detection rules mapped to the MITRE ATT&CK framework — specifically the Exfiltration tactic (TA0010) — flag anomalous outbound data transfers by volume, destination, and user context. When a user posts an unusually large document to an external AI API, Ora’s graph-based attack storyline reconstruction links that event to prior authentication logs, file access events, and network flows, giving SOC analysts a complete picture rather than an isolated alert. For Indian enterprises, Ora’s tiered retention architecture — hot, cold, and archive storage — supports CERT-In’s direction on 180-day in-country log retention, ensuring audit evidence is available for both internal investigations and regulatory inquiries.
In multi-vendor estates where NOC visibility is fragmented across different consoles — FortiGate logs here, switch telemetry there, WAN monitoring elsewhere — Shadow AI traffic often falls through the cracks because no single team has full network visibility. Ora’s Network Management System capability provides unified observability across firewalls, switches, access points, and WAN/SD-WAN links. LLDP/CDP topology discovery maps the full network path from endpoint to internet gateway, and ML-based anomaly detection flags new external destinations appearing in traffic flows. When an employee connects their laptop to a hotel Wi-Fi network and circumvents corporate controls to access an unapproved AI service, Ora’s network path tracing can detect the deviation in endpoint and VPN telemetry, triggering an investigation before data loss occurs at scale.
For manufacturing sites, retail chains, and multi-site enterprises, Shadow AI risk does not exist in isolation from physical security. PrahiX Ora’s video surveillance (VMS) capability — supporting ONVIF, Hikvision, and Dahua camera infrastructure — brings physical and network security under a single operations view. When a digital investigation identifies an anomalous data transfer event, the SOC analyst can correlate it with physical access logs and video footage from the same time window. Did the user badge into the server room? Was anyone else present at the workstation? This physical context is increasingly relevant for insider threat investigations where establishing intent and access opportunity matters for HR, legal, and regulatory purposes.
CERT-In’s six-hour incident reporting window is the compliance deadline that concentrates minds in Indian security operations centres. When a Shadow AI data leakage event is confirmed, the clock starts immediately — and manual response processes that work for low-volume incidents simply cannot scale to meet this deadline under real-world pressure. Ora’s SOAR capability provides pre-built playbook automation for data exfiltration scenarios: automatically quarantining the affected endpoint, pushing blocklist entries to FortiGate to sever communication with the offending external AI service, notifying the CISO and legal team, capturing a forensic snapshot of the endpoint, and pre-populating the CERT-In incident report template with the event details captured from SIEM logs. Automation is what makes the 6-hour window realistic rather than a perpetual source of compliance anxiety.
If your organisation wants to understand how Ora can be deployed and operated within your security environment, the PJ Networks team is available to discuss your specific requirements.
All of the detection and response capabilities described above are most effective when paired with a network enforcement layer. FortiGate NGFWs, which PJ Networks deploys and manages as part of its MSSP service, provide several capabilities directly relevant to Shadow AI governance:
For Indian enterprise IT leaders, the Shadow AI governance challenge requires action across three horizons:
Shadow AI represents a genuinely new category of insider risk — one driven not by malice but by enthusiasm, productivity pressure, and an absence of clear guidance. Indian enterprises that treat it as a technology problem to be blocked will find employees routing around controls. Those that treat it as a governance, culture, and detection challenge — with appropriate technical enforcement at the network layer — will be better positioned for the DPDP, CERT-In, and reputational demands of operating in today’s environment.
PJ Networks’ 24/7 NOC/SOC services, FortiGate NGFW management, and managed deployment of the PrahiX Ora platform provide Indian enterprises with the detection depth, operational coverage, and response automation needed to address this threat — without requiring organisations to build these capabilities in-house from scratch.
Ready to assess your Shadow AI exposure and build a GenAI governance programme? Contact the PJ Networks team to schedule a Shadow AI discovery assessment for your organisation.