WatchGuard warns of shadow AI & weak security habits

WatchGuard has published research showing widespread unauthorised AI use and unsafe security habits among employees, highlighting a visibility problem for small and mid-sized businesses.

The study found that 64% of employees use unauthorised AI tools for work. It also found that 76% reuse passwords across multiple accounts, 70% use public Wi-Fi for work, 50% access corporate resources without VPN protection, and 55% use work devices for personal activities.

The findings point to a gap between corporate security controls and day-to-day employee behaviour. WatchGuard surveyed 684 employees at small and mid-market organisations with 50 to 500 staff across the US, UK, Germany, France, Spain, Australia, Mexico, and Brazil.

Less than 30% of respondents believe their organisation maintains an accurate inventory of software in use. Nearly 40% said their company does not have full visibility into the applications employees use.

Shadow AI

The figures suggest consumer AI tools have become a new source of unmanaged risk inside businesses. Employees using unauthorised services for work can create exposure if companies do not know which tools are in use or what data is being entered into them.

That issue sits alongside more established cyber risks. Password sharing remains common, with 30% of respondents saying they share passwords with others. Reusing passwords also leaves multiple accounts exposed if one set of credentials is compromised.

Public network use is also widespread. With 70% using public Wi-Fi for work and half accessing company resources without VPN protection, organisations face greater exposure to data interception and unauthorised access on unsecured connections.

Using work devices for personal activity adds another layer of risk. The report said this can increase the chance of malware infection, phishing attempts, and exposure to websites or applications outside company controls.

Hybrid pressures

The findings come as hybrid and remote work continue to blur the line between business and personal technology use. That shift has made it harder for many employers to monitor how staff access company systems and which applications they rely on.

"Organisations are investing in security tools, but many still lack visibility into how employees actually work," said Marc Laliberte, Director of Security Operations at WatchGuard.

"Everyday behaviours, from AI usage to password practices, create risk that traditional controls aren't designed to address."

The report frames the challenge as both a governance and technical issue. Businesses may have formal security products in place, but weak oversight of staff behaviour, approved software, and acceptable data handling can still leave blind spots that established defences do not cover.

For managed service providers, the results also point to a broader advisory role with smaller business customers. Providers have an opening to help clients set policy, improve visibility into software use, and strengthen staff awareness of security risks.

"These findings highlight a broader shift in cybersecurity risk. As organisations adopt new technologies and support distributed work, managing human behaviour is becoming a core requirement," said Laliberte.

"For MSPs, this is an opportunity to expand beyond technology into user risk visibility, policy governance, and continuous security awareness."

The report highlights steps including password managers and multi-factor authentication, clearer policies on acceptable AI use, better identification of unauthorised software, and broader use of VPNs and zero trust security approaches for staff working beyond the office.

The survey is based on self-reported employee behaviour, offering a snapshot of how staff describe their own security practices rather than a direct audit of company systems. Even so, the scale of the responses points to persistent weaknesses in basic cyber hygiene across the organisations covered by the research.