Shadow AI outpaces Singapore governance controls

Employee adoption is exposing data and operational risks as firms struggle to track AI use and enforce internal policies.

Singapore companies are struggling to govern artificial intelligence as employee adoption moves faster than internal controls, exposing businesses to data leakage, unreliable outputs and weak oversight.

Modern applications now combine internal code with open-source packages, cloud services, AI-generated code, models and third-party tools. Sunny Rao, senior vice-president for Asia-Pacific at JFrog, said each component risks another route into business systems.

“The complexity crisis that you asked about comes from this gap between software speed and governance speed,” Rao said.

JFrog research found that 60% of Singapore DevSecOps stakeholders regard governance and policy enforcement as their largest time burden, whilst 41% said reviewing AI-generated code drains resources.

Reliance on external providers is adding to the pressure. Christine Low, head of observability for Asia-Pacific, Japan and China at Splunk, said 63% of technology leaders attributed downtime to third-party issues.

Shadow AI presents a more immediate concern because companies may not know which tools employees are using or whether sensitive information is being uploaded. Eighteen per cent of Singapore organisations have policies against unauthorised AI tools but no mechanism to detect violations, according to Rao.

“An AI policy does not equal AI control,” he said, warning that outright bans could push usage further underground.

Low said employees may expose source code, customer information or commercial data through unapproved tools. AI-generated errors can also spread across workflows before reaching customers or critical systems.

“Shadow AI is no longer a future issue. It’s actually a current reality,” she said.

Companies should link asset visibility with policy enforcement across software, AI models and third-party services. Although 95% track application ownership, 54% need at least a week to produce compliance evidence for one application.

Low added that monitoring must extend across infrastructure, applications, security and AI workloads to detect failures faster and reduce disruption.

Follow the link for more news on

cybersecurity

Reaching the people who run Asia's businesses is harder than it used to be.

Inboxes are crowded. Attention is short. The executives you most want to reach — the founders, CFOs, and operators who actually move budgets — are the hardest to find through the usual channels. If you're building a company, a category, or a reputation, you already know this.

We've spent twenty years building the room they read. Singapore Business Review is where senior decision makers in Singapore and across Southeast Asia come for business coverage they can't get elsewhere — in print, online, and in person at the summits and roundtables we host across seven markets.

If you have something these readers should know about — a point of view worth publishing, a product worth their attention, an event worth their time — we'd like to hear what you're trying to do.

Book a meeting

| Or download the media kit (PDF)

240,000 senior readers quarterly in print Top 1,700 Singapore companies reached

7 markets across Southeast Asia