CISO Ryan Davis Flags Shadow AI as Top Security Risk

A CISO's Top 2026 Worry: AI Tools Nobody Approved

In a CISO Conversations interview published by SecurityWeek on November 5, 2026, Ryan Davis, chief information security officer at New Charter Technologies, says the risk keeping him up at night this year is shadow AI: employees quietly adopting AI chatbots, coding assistants, and AI-powered automation tools without security or IT sign-off. According to the interview, Davis's own background started with hacking his school's network as a teenager before he built a career running enterprise security, a path the profile frames as shaping how he now thinks about unauthorized activity inside an organization. For Bellator Cyber Guard's readers, including healthcare practices, tax professionals, and small-business leaders, the interview is a useful prompt to ask a concrete question: do you actually know which AI tools your staff are using, and what they're pasting into them?

What "Shadow AI" Actually Means

Shadow AI is the use of artificial intelligence tools, chatbots, browser extensions, AI coding assistants, or AI features built into everyday software, by employees or teams without formal review or approval from an organization's IT or security function. It is the direct successor to "shadow IT," the long-standing problem of staff adopting unsanctioned cloud apps or personal devices for work. The distinction that makes shadow AI harder to manage is data retention: the moment a user pastes a document, patient note, or spreadsheet into a public AI chatbot, that content can be transmitted to and potentially stored by a third-party service outside the organization's control, often with no record that it ever happened.

Why an Unconventional Career Path Shapes This Concern

Per the SecurityWeek interview, Davis's career began with hacking his own school's network, an experience the profile presents as formative for how he evaluates adversarial and unauthorized behavior inside organizations today. That background is relevant to shadow AI specifically: the same curiosity and convenience-seeking that once led a student around network restrictions is, in Davis's framing, now leading employees around AI governance policies, usually without any intent to cause harm. The underlying concern the interview raises is not that staff are acting maliciously, but that unmonitored AI use creates blind spots a security team cannot defend because it cannot see them in the first place.

What Healthcare Practices and Tax Offices Should Check Now

The shadow AI concern Davis describes applies directly to small and mid-sized organizations handling regulated data, not just large enterprises. A few concrete steps close most of the gap:

• Run a plain-language inventory. Ask staff directly which AI tools they currently use, including free chatbots, AI features inside office software, browser extensions, and transcription or note-taking apps. Many organizations find tools in daily use that IT never approved.
• Check what data has gone into them. Identify whether protected health information covered by the HIPAA Security Rule, or taxpayer data covered by the IRS's Publication 4557, Safeguarding Taxpayer Data, has ever been pasted into a public AI tool during drafting, summarizing, or troubleshooting.
• Write a one-page AI use policy. Name the tools that are approved, the data types that may never be entered into an AI tool, and a simple process for requesting a new tool. Most small practices have no AI policy at all, which is the single biggest gap this interview points to.
• Review vendor-bundled AI features. Practice-management, EHR, and tax-prep platforms increasingly ship AI features that are enabled by default. Check admin settings quarterly to confirm which AI features are active and what data they are permitted to process.
• Add AI activity to endpoint monitoring. Where feasible, use existing endpoint or web-filtering tools to flag uploads to unsanctioned AI domains, the same way many organizations already flag uploads to unsanctioned cloud storage services.

What This Means for Your Business

Shadow AI use does not automatically create a legal violation, but it can complicate compliance work that already depends on knowing where sensitive data lives. Under the HIPAA Security Rule, covered entities and business associates are required to conduct a risk analysis covering where electronic protected health information is created, received, maintained, or transmitted; AI tools that employees adopt on their own may not appear in that analysis at all, which can leave a documentation gap if a regulator or auditor asks where patient data has traveled. Tax professionals face a similar exposure under the safeguards described in IRS Publication 4557, which calls for written information security plans covering the systems and tools used to handle taxpayer data. Treating the Davis interview as a prompt rather than a crisis, the practical move for any small organization is the same: inventory current AI use this month, document what is and isn't approved, and review that list on a recurring schedule as new AI features keep arriving inside the software your team already uses.