Shadow AI incident response begins with logs that may already be gone

Brandy Wityak, VP of Complex Matters at LevelBlue, warns that shadow AI incident response often begins with logs that have already rolled over, as firewall records of outbound traffic to AI platforms can disappear before responders arrive. Regulators assess whether companies did enough to monitor unauthorized AI use, highlighting the gap between written AI policies and actual controls.

In this Help Net Security interview, Brandy Wityak, VP of Complex Matters at LevelBlue, explains what happens in the hours after a shadow AI incident. She describes how quickly logs roll over, why firewall records of outbound traffic to AI platforms are often gone before responders arrive, and what regulators look for when they assess whether a company did enough. Wityak also discusses the gap between an AI policy in a wiki and a control … More https://www.helpnetsecurity.com/2026/07/28/brandy-wityak-levelblue-shadow-ai-incident-response/ The post Shadow AI incident response begins with logs that may already be gone https://www.helpnetsecurity.com/2026/07/28/brandy-wityak-levelblue-shadow-ai-incident-response/ appeared first on Help Net Security https://www.helpnetsecurity.com .