Your employees are already using AI. Here’s what we found when we looked.

Over the past few months we started paying attention to something most small businesses haven’t looked at yet: how much company data is going out to public AI tools.

We checked traffic across several client networks. Not a formal study, just looking at what the firewalls and DNS logs already had. Every single site had regular traffic to ChatGPT, Gemini, Copilot, Claude, or some mix of them. None of those companies had a policy about it. Most of the owners had no idea it was happening.

That’s not a surprise, and it’s not really a people problem. If a tool helps someone finish a report in ten minutes instead of an hour, they’re going to use it. The problem is what goes into the prompt. We’ve seen customer lists pasted in to “clean up the formatting.” Contracts uploaded to get a summary. Financial spreadsheets dropped in for a quick analysis. Once that data leaves your network, you have no control over where it lives or how it’s used, and depending on your industry that can be a compliance issue on top of a confidentiality one.

A few things we tell our clients:

• Start by finding out. You can’t manage what you can’t see. Most business firewalls can report on AI service traffic by site and by user. Pull that report before you write a policy, because you’ll write a better one when you know what people are actually doing.

• Write a short policy that people will actually follow. One page. What’s fine to put into a public AI tool, what isn’t, and which tools the company approves. Banning everything doesn’t work; people just switch to their phone.

• Give them a sanctioned option. If you give the team a business-tier AI account where the data isn’t used for training and you control the admin side, most of the shadow usage goes away on its own.

• Block the rest where it matters. For the accounting, HR, or anyone handling regulated data, restrict the unapproved tools at the network level.

We’ve packaged this up as a service because we kept getting asked for it: a visibility report of your current AI traffic, a policy you can put in front of staff, and the network controls to enforce it. But even if you do nothing else, pull the report. What’s in it usually changes the conversation.