DOP 349: Shadow AI Is Going to Be a Thousand Times Worse Than Shadow IT

Episode 349

Show Notes

#349: Every platform you already own is about to have AI baked into it. Not next year. This year. That is Ben Wilcox’s blunt prediction, and Ben is the CTO and CISO at ProArch, so when he says shadow AI is going to make shadow IT look quaint, it is worth slowing down to figure out what that actually means. The data leaves your stack through tools you already paid for, through features the vendor shipped without asking, through copilot agents nobody filed a ticket for.

Here is the uncomfortable part. This is not a new problem. It is the exact same retroactive-security failure pattern that broke DevSecOps, just with higher stakes and a faster clock. A pen test done six months ago is already obsolete because the app added AI in the meantime. Models get deprecated on seven-month windows while frameworks still get years of support. The whole “we will deal with it at the end” approach that worked badly for cloud and worked worse for containers is going to be catastrophic for AI.

The fix is older than the problem. Landing zones. Well-architected frameworks. A storage account that already has the right policy. An API gateway already in front of the API. The developer should not be picking from twenty checkboxes to figure out which combination is secure – that decision should already be made before the ticket lands. Stop forcing developers onto the security team. Stop running security reviews while the head developer sweats through his shirt right before release. Build the foundation up front and let the developer deploy into it.

Then the harder question. The leaders making these calls today are the same engineers who lived through every prior cycle of this exact pain. Why are they letting another generation eat it again? Viktor’s answer is one line: “It’s my time now, baby.” Ben does not disagree. PE pressure, VC timelines, race-to-market everything – the budget exists, the tools exist, the patterns exist. What is missing is the will to invest two weeks up front so the last two months do not turn into panic. Ben’s practical advice for any leader dipping a toe in: do not do it alone, inventory everything, talk to sales and finance and the developers, and assume the conversation you are having today will be obsolete in six months.

Frequently Asked Questions

Why is shadow AI a bigger problem than shadow IT was?

Ben Wilcox, CTO and CISO at ProArch, tells DevOps Paradox episode 349 that AI is arriving inside products an organization already runs, rather than as something staff go out and adopt on their own. His advice to security leaders is to assume any platform they own now has AI in it, then work out where the data goes as a result. Darin Pope’s summary, which Ben agrees with, is that this makes shadow AI far worse.

Why does DevSecOps not work in practice?

Ben Wilcox argues on DevOps Paradox episode 349 that the failure is forcing developers onto the security team without good guardrails or planning ahead. He describes watching a lead developer sweat through a security review held just before an initial release, long after the decisions were locked in. Viktor Farcic adds that security stays reactive, telling teams what they did wrong instead of building the services that would make secure work the easy path.

How should teams handle AI models being deprecated?

Ben Wilcox says on DevOps Paradox episode 349 that almost nobody plans for it at the start of a project. Darin Pope compares it to upgrading a framework from version three to version four, only worse, because model behaviour is non-deterministic and nothing tells you what changed. Ben suggests choosing smaller models that shift less between releases, and running an ongoing test practice that checks whether familiar prompts still produce acceptable output.

What changes about penetration testing when an application uses AI?

Ben Wilcox explains on DevOps Paradox episode 349 that his teams have had to rebuild their approach. An application tested one way six months earlier comes back needing a different method entirely once AI is added, because the attack surface moves. They now have to account for the supply chain, how identities are handled, and how data flows through the system. His teams use AI to generate those test cases rather than writing them by hand.

Where should a CISO start with AI?

Ben Wilcox’s advice on DevOps Paradox episode 349 is to start with an inventory, and not to do it alone. He suggests going across the whole organization and talking to sales and finance rather than only developers, since commoditized tools get picked up everywhere. From there, look at how data is being used inside applications, think through what a failure would actually look like, and log enough to reconstruct it later.

Why do organizations misjudge what AI will cost?

Ben Wilcox tells DevOps Paradox episode 349 that he sees projections missed in both directions. The uncomfortable version is a team budgeting eight thousand dollars a month and landing at fifteen. What follows is usually a reassessment of whether the value matches the spend. Where the capability is built into a product, companies tend to absorb the difference; where it is an internal tool, the conversation gets considerably harder.

What is the DevOps Paradox podcast?

DevOps Paradox is a weekly podcast co-hosted by Darin Pope and Viktor Farcic, covering DevOps, platform engineering, and modern software delivery. Episode 349 features Ben Wilcox, CTO and CISO at ProArch, on shadow AI, why security reviews keep arriving too late, and what changes about testing once an application has a model inside it. Every episode page carries audio, video, and a full transcript.

Episode Transcript

Read the Full Transcript

Topics

Share and Download

Guests

Ben Wilcox

Ben Wilcox

Ben Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, where he helps organizations modernize, secure, and scale through data, cloud, and AI. With a rare dual lens across technology and security, Ben bridges innovation and risk—ensuring transformation efforts are not only cutting-edge, but resilient and trustworthy.

At ProArch, a top Microsoft Partner, Ben works closely with enterprise leaders to turn technology ambition into measurable business outcomes. He brings a business-first mindset to complex technical challenges, guiding teams through cloud modernization, AI adoption, and security strategy in highly regulated and fast-evolving environments.

Ben is known for his practical, no-hype approach to leadership—focused on aligning engineering, security, and business priorities to drive real impact.

Hosts

Darin Pope

Darin Pope

Viktor Farcic

Viktor Farcic

Viktor Farcic is a member of the Google Developer Experts and Docker Captains groups, and published author.

His big passions are DevOps, Containers, Kubernetes, Microservices, Continuous Integration, Delivery and Deployment (CI/CD) and Test-Driven Development (TDD).

He often speaks at community gatherings and conferences.

He has published DevOps Paradox and Test-Driven Java Development.

His random thoughts and tutorials can be found in his blog The DevOps Toolkit.