Shadow AI: How MSPs Are Helping Customers Get AI Use Under Control

Phalanx Technology Group, Xperteks, Troinet, JMXi, Four Winds IT, Critical IT Solutions and Geeks-r-Us shared their approaches to the issue.

Employees are adopting artificial intelligence tools whether their employers are ready for it or not. With shadow AI an apparent inevitability, solution providers are working to balance safeguarding clients’ data and IT estates with enabling AI use and experimentation.

CRN reporters asked solution provider attendees at CRN parent The Channel Company’s XChange NexGen 2026 conference in Orlando, Fla., to answer, “How big of a concern is shadow AI, and how are you helping customers manage it?”

Executives with Phalanx Technology Group, Xperteks, Troinet, JMXi, Four Winds IT, Critical IT Solutions and Geeks-r-Us shared their approaches to the issue, whether scanning for shadow AI use is enough and the dangers that can come with even sanctioned AI.

Clearwater Security & Compliance, a Nashville, Tenn.-based pure-play cybersecurity and compliance firm for healthcare, said in a report this month that 91 percent of surveyed healthcare organizations could not verify what AI is actually running in their environments.

Nearly half of healthcare organizations have AI policies without technical enforcement behind them, according to the report. About 31 percent have identified employees using unapproved AI tools without oversight as their greatest internal AI-related concern. Only 14 percent could demonstrate that their vendors’ AI controls are fully verified.

Read on for how these solution providers are approaching shadow AI and be sure to read more of CRN’s NexGen 2026 coverage on supporting and protecting clients and whether AI is actually allowing solution provider customers to cut workforce sizes.

Kelly Yeh

President

Phalanx Technology Group

Chantilly, Va.

Shadow AI for me is now a big business opportunity. … Once you can document and show the client, “Hey, you told me you only had Copilot. You told me that there’s no AI at all. Here are the 85 AI entities you’ve got going.”

That’s step one. Step two, then, is put the governance pieces in. … Adoption [rates of AI are] at various levels. Everyone knows it’s a challenge. It’s kind of like the iPhone. iPhone came out, BYOD (bring your own device) policies blew up. … It is paradigm-shifting because it is coming [employee]-driven. “Hey, I just asked ChatGPT. And this is the answer it gave me.”

Marcial Velez

President, CEO

Xperteks Computer Consultancy

New York

What’s happening right now is that there is [an] influx of AI tools that are starting to come out.

And not just ChatGPT. And what happens is it’s becoming so easy and productive to start doing things that people are just starting to input stuff that they’re not supposed to be putting in. But they are not doing it out of malicious intent or anything else.

As an MSP, how do we now create that environment for them to work with these AI tools, identify what they are and be able to classify them as approved AI tools?

And have it so when they do put something that they inadvertently [submit sensitive data]—because [let’s say in a document they want to feed to AI], they hit ‘select all’ and hit “copy” and then hit “paste.” But they don’t realize … on page three there was [sensitive data].

So how do you prevent it to make sure that when they do [try to] paste that, they’re not allowed? … It is an opportunity for MSPs to start now figuring out, OK, how do we create the governance stage, just like how we did with cybersecurity. Just like how we did with other solutions.

Still keep the [AI adoption] mandate, which is: How do we create a productive, effective, scalable environment that they can grow in?

Everyone’s going to grow with AI, but they don’t necessarily understand the guardrails. So it’s up to us to figure out where we can put the guardrails that may not be visible to them, but it allows them to experiment, create and do more with AI.

I want them to hit the guardrail and know it and then, ‘Oh, I can’t do that. Oh, I shouldn’t have done that.’ It’s like phishing. Why do we have simulators? Same way to drive behavior.

There needs to be some improvement [with AI guardrail tools]. We think that is an emerging space.

Wayne Roye

CEO

Troinet

New York

It’s coming up in customer conversation. And we’re actually bringing it up because everybody’s hearing about it. So you get ahead of that train before it hits you and runs you over.

One of the worst things you do is tell people not to do something. It’s not stopping them from considering AI. It’s for them to get a better understanding of what AI can do and what’s it about.

Here’s the biggest gap: They don’t understand it, and they think it does everything. So if you start from the beginning and say, ‘OK, AI is going to solve a problem. Define the problem you have first.’

Then we can talk about how we can implement things that may not even be AI. Maybe it’s something else.

And if we can get ahead of that train in educating and it is from the top down—even though the people at the bottom are the ones trying to play with it, but if you don’t get the top saying, ‘Hey, this is what our company is about,’ you cannot really create change. … If you go from the top down, you have that education and say, ‘OK, we as a company, our culture, we’re going to embrace it. But this is how we’re going to do it.’

[We are not doing shadow AI] scans. It is conversation more than anything else.

Because, at the end of the day, scans are great. But do you think that really stops them when you leave for the day? So, it’s taking them away from, “Don’t.”

Say, “OK. If we are going to do it, what’s the best way as a company to do it?”

It’s like your children. The minute you tell your child not to do it, that’s the first thing they want to do as soon as you walk away.

John Medaska

CEO

JMXi

St. Petersburg, Fla.

It’s a big concern for us as we work to protect our customers, both internally and externally, from sensitive company information leaking out.

We conduct security, Wi-Fi and network assessments to make sure their data is staying within the organization and not being exposed externally. The challenge is that company owners often have no control over what’s happening and, in many cases, don’t even realize it’s going on.

Dylan Borden

Vice President, Operations, Growth

Four Winds IT

Sarasota, Fla.

I think shadow AI is becoming one of the biggest concerns for the C-suite executives we work with, if not the top concern. It’s definitely in the top three.

We’re running shadow AI reports for all our clients so they can see what tools their teams are using and better understand how those tools are interconnected.

From there, we’re helping them develop a more streamlined strategy for scaling AI in a way that keeps it under company control, rather than leaving employees to use whatever tools they want.

Hani Eshack

Founder, CEO

Critical IT Solutions

Clarksburg, Md.

It’s a huge concern, especially lately, for our customers and for ourselves because our job is to protect them.

The challenge is [it] also comes from the customer because they hear about it, they want to use it, they are using it, their users are using it.

So our job is to protect all of that. So orchestrating the issue, explaining [it] to them, bringing in the tools, having a policy to start with. So, what is your policy? Which tools are you going to admit? And then protecting everybody else from using anything else, such as personal ChatGPT.

We’re blocking them right now from going to that. If you’re going to go, go through the company policy.

Then something like that, where you have a lot of processes—PowerShell, we have a zero trust to prevent PowerShell from running behind the scenes. So it’s still [in] progress.

We’re trying to figure out and define a strategy for us to go to clients with solutions. We can’t just tell them, “There is a problem there. Stop doing it.” It’s not going to happen. Not realistic.

So our job is to educate, put the policy together and make sure that they’re getting the worth. AI is really a good tool, but it’s also risky. There’s a lot of risk associated with it. Once they understand it, I think it makes a lot of sense. That’s our approach. But it is very challenging to deal with that.

David Yates

Founder, Managing Principal

Geeks-r-Us

Fort Myers, Fla.

It’s a bigger concern for me than it is for my clients, unfortunately. I am lucky in that we deal with a lot of professional offices who have a natural reticence to jump on the latest tools. So we haven’t had a lot of problems with renegade staff members rolling things out that we don’t know about.

But we have been struggling with—how do we put the tools in place? How do we put tools in place so that we can audit that and keep a handle on it? And that’s one of those few things that still keep me up at night.

There have to be some that are slipping through the cracks, that there are people doing things that we don’t know about necessarily. But for ourselves, when we have that dialog with the client, what we’ve been trying to do is roll out projects that we know are containable and verifiable.

Because that’s one of the other big problems that we see, is that their software will let them write [using] AI, but there’s no QA to that. There’s no quality assurance. … And it might be right today, but we don’t know that because of changes in how they code client types, that there’s not going to be a quality drift on it.

And so until we can have tools where we have a better handle on that. And so we’ve been going into it slowly. And our clients have been very responsive to that—to keeping it in containable projects that can be verified and managed either by us or by their staff.