Khaled Alizai

Enterprise AI is already in production, but security models haven't caught up. Teams are deploying copilots, agents, and AI-powered workflows faster than organisations can define acceptable risk, leading to inconsistent decisions and growing exposure. The challenge isn't understanding every AI threat, it's deciding where to draw the line and enforcing it consistently. This panel focuses on a critical question: how do organisations define and apply AI risk boundaries in practice, across data use, model behaviour, and autonomy, without slowing down delivery?

The term "Shadow AI" is used everywhere, but often without precision. It is not just unsanctioned use of public tools. It spans a spectrum, from casual employee usage to internally built applications calling external model APIs, to semi-approved experiments that never pass through full governance. Some of it is visible, some of it is tolerated, and some of it is completely unknown. What matters is not the label but the condition: AI capability operating without clear oversight, consistent controls, or full visibility. This panel focuses on making that condition manageable and on where Shadow AI actually sits in the enterprise, how to detect it in practice, and how to bring it under control without slowing delivery or relying on bans that do not work.