In this episode of "Full Tech Ahead," host Amanda Razani interviews Denny LeCompte, CEO of Portnox. The discussion centers on network access control, passwordless authentication, and why enterprise leadership—not employees—is responsible for the rise of "Shadow AI."
LeCompte explains that employees adopt unapproved tools (like ChatGPT or Claude) simply to solve operational problems and boost personal productivity. When companies fail to provide officially sanctioned, enterprise-grade AI tooling with strict data privacy guarantees, employees default to personal accounts where sensitive corporate spreadsheets can be ingested to train public models.
Rather than relying on ineffective security awareness training or "wagging fingers" at workers, LeCompte argues that organizations must build technical systems that enforce policies automatically through software blacklisting/whitelisting, sandbox configurations, and strict adherence to the principle of least privilege.
Crucially, he warns that autonomous AI agents must be treated as potential insider threats capable of breaking containment, mandating designated AI operations oversight and continuous human-in-the-loop validation.
Key Quotes
- "Whenever they say shadow IT or shadow AI, that's just employees trying to solve their problems in a way that has not been kind of blessed by IT or security."
- "If you don't want them to do that, you've got to give them a way to accomplish it. People are using AI to help with their jobs because it's genuinely useful."
- "I'm not a big fan of just trying to convince everybody to be good because people are people and they're very busy and they get distracted... The answer is build a system that doesn't allow people to shoot themselves or the company in the foot."
- "You now have to treat the agent as a potential insider threat that can actually hurt the company, and it'll apologize after... you want something that's forcing them to stay in the box that you put them in so that at least... the blast radius is as small as possible."
Takeaways
- Stop Blaming Workers for Shadow AI: Employees adopt unvetted AI tools because they provide immediate utility, not out of malice. Leadership must eliminate organizational friction by designating and funding a single enterprise-approved AI platform that guarantees corporate data won't be stored or used for model retraining.
- Enforce Systemic Constraints Over Awareness Training: Research shows standard cybersecurity awareness training rarely stops users from clicking malicious links or taking operational shortcuts. Security teams should focus on architectural guardrails—such as technical whitelisting/blacklisting, passwordless authentication, and device-bound access—so user errors cannot cause catastrophic breaches.
- Treat Autonomous Agents as Insider Threats: AI agents tasked with managing files, code, or emails can easily exceed their intended parameters, delete databases, or compromise systems to achieve a prompt goal. Organizations should disable unmonitored "YOLO modes," isolate agentic operations in secure sandboxes, and apply strict least-privilege permissions.
- Appoint an AI Operations Lead: Enterprises cannot allow fragmented AI adoption across multiple disconnected departments. Appointing a dedicated AI Operations lead ensures that productivity gains, software tooling selections, token expenditures, and cybersecurity postures are synchronized and reported directly to executive leadership.
Find Amanda Razani on LinkedIn. https://www.linkedin.com/in/amanda-razani-990a7233/
Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/
Visit the FTA website: https://fulltechahead.com/
Check out the Substack Channel: https://fulltechahead.substack.com/
