AI integration in the business world has seen a steep increase over the past several years, despite the fact that the practical application of artificial intelligence is still in its infancy. A recent survey found that 78 percent of companies used AI in at least one business function during 2024, a figure that was up from 55 percent in 2023.
The widespread adoption of AI is being driven by the general belief that the technology gives companies a competitive edge by acting as an automator, multiplier, and all-around problem solver. But a deeper assessment of AI integration reveals hidden risks that pose threats to a company’s autonomy and security.
The Rise of Third-Party Reliance
For the vast majority of companies, developing AI-driven tools in-house is cost-prohibitive. Consequently, most companies use third-party vendors to leverage AI. From file management systems like Dropbox and Google Workspace to no-code platforms that promise to eliminate the need for traditional software development, businesses are increasingly reliant on third-party AI systems.
The short-term benefits of using third-party systems are obvious. They eliminate development costs, provide expert support, and secure the promise of ongoing improvements and enhancements, all of which are features that are very attractive to companies anxious about falling behind the AI curve.
In the long term, however, relying on third-party AI tools exposes companies to several risks, including vendor lock-in, security vulnerabilities, and the accumulation of technical debt. The AI-driven solutions offered by third-party providers promise democratized technology and increased efficiency, but in reality, they often create more complex problems than they solve, particularly when organizations surrender control of their data and processes to external vendors.
Surrendering Control to External Vendors
To understand the threats posed by an over-reliance on external AI providers, companies must understand the exchange that takes place during the integration process. As they leverage the capabilities that vendors provide, they often must allow their third-party vendors to tap into sensitive internal information.
When companies use Google Workspace with Gemini, for example, there is the potential for their entire organizational knowledge base to become accessible to Google’s AI systems, including confidential strategic documents, financial records, and employee communications. The potential for this access lies in Google's terms of service, which grants the tech giant broad rights to process the data brought into Workspace to “make improvements” to its services.
Utilizing the AI-powered capabilities of Dropbox poses a similar risk. Dropbox’s “AI Principles” state it will “not build generative AI models using customer content without consent.” But media reports suggest that to prevent your intellectual property, trade secrets, and sensitive client information from being analyzed by Dropbox's machine learning models requires an opt-out. And even when you’ve opted out, sharing those files with a Dropbox user who hasn’t taken the same precautions could make your content vulnerable.
Putting trust in a vendor’s security controls
Even in cases where vendors provide AI-powered efficiency without the risk of sensitive data being used in AI training, tapping into third-party capabilities introduces the risk of security vulnerabilities. With Microsoft 365 Copilot, for example, deep integration across Word, Excel, PowerPoint, Teams, and Outlook means AI has access to virtually every business document and line of communication, creating a single point of failure for organizational security.
Even in cases where the highest level of traditional security controls is in place, the threat exists for AI systems to inadvertently expose sensitive data across organizational boundaries. Using a generative AI chatbot like ChatGPT for help with coding, for example, can inadvertently cause proprietary designs to become publicly accessible by adding them to the chatbot’s pool of knowledge. Similarly, using generative AI platforms to contribute to documents containing confidential information can also lead to that information becoming publicly available.
Overall, third-party AI integration creates a cybersecurity paradox for companies. Companies enter the paradox seeking enhanced efficiency, but find that they must create new attack vectors to gain access to the benefits they were promised.
Consider, for example, that achieving the highest levels of AI efficiency from tools like Microsoft 365 Copilot requires giving AI read/write access to entire file systems, email accounts, and databases. Limiting access to specific folders or data types for the purpose of reducing attack surfaces compromises the effectiveness of AI. Companies seeking a balance between efficiency and security that they find acceptable may find that today’s AI systems are not worth the risks they require users to embrace.
As AI-driven “opportunities” continue to flood the business landscape, companies must carefully evaluate where AI integration provides genuine value versus where it creates unacceptable risks. Companies that maintain control over their data, logic, and infrastructure while thoughtfully integrating AI in ways that enhance rather than replace their current operations will be better positioned to navigate an uncertain technological future.
The best results will be found not in avoiding AI tools entirely. Instead, they will be found in understanding their fundamental limitations and maintaining the ability to function independently when these systems inevitably fail to deliver on their promises.
– Haven Chavous, Senior Business Intelligence Architect for Hearthfire Holdings, is a fintech software developer with experience working on financial modeling, data science, analytics, and FP&A automation. He assists Hearthfire Holdings with its pioneering work in the self-storage industry, providing scalable and efficient solutions that empower the company’s partners to grow wealth beyond financial returns.
Copyright © 2025 California Business Journal. All Rights Reserved.
For California Business Journal Disclaimers, go to /terms-conditions/.
