Why Shadow AI Creates Insider Risk in Microsoft 365 ft. Gabriel Friedlander

Organizations tend to approach AI risk from one of two directions: restrict it heavily or encourage adoption quickly. Gabriel Friedlander, Founder and CEO of Wizer and former founder of ObserveIT, sees problems with both.

In this episode of Demystifying Microsoft, Nathan and Gabriel discuss why organizations are dealing with a new category of insider threat, how security awareness needs to evolve alongside it, and why IT leaders should establish a baseline of actual AI usage before reaching for controls. They also look at what happens next because AI may increase what a team can produce, but that makes governance more important, not less.

Gabriel Friedlander is the Founder and CEO of Wizer, a security awareness platform used by approximately 20,000 organizations.

Gabriel has spent more than a decade focused on insider threat prevention, human behavior, and security awareness. Before Wizer, he co-founded ObserveIT, an insider threat detection and prevention company that was acquired by Proofpoint. His work now focuses on helping organizations make security training more effective as new risks, including shadow AI and AI-driven insider risk, change how employees interact with company data.

Nathan Taylor is Senior Vice President and Global Microsoft Practice Leader at Sourcepass, where he leads the Sourcepass Center of Excellence for Microsoft, also known as the Sourcepass MCOE. With nearly two decades of experience, he helps organizations manage complex Microsoft cloud and security decisions by turning technology into secure, scalable outcomes.

Gabriel explains why companies that believe employees are not using AI can easily lose visibility instead. When approved tools are unavailable, employees may bring personal AI accounts into the workflow to keep pace with expectations.

AI agents can access data, take actions, and make decisions, but they may not have the identities and monitoring structures IT expects from human workers. Gabriel argues that this creates a genuine insider-risk problem.

Before assuming policy is working, Gabriel recommends finding out what employees are actually doing: which tools they believe are approved, whether personal accounts are involved, and whether people know where to go with questions.

Gabriel explains Wizer’s approach to awareness content: roughly 90 seconds, direct, useful, and stripped of repetition. If the audience has to watch, that does not mean the content should stop competing for their attention.

Gabriel compares security with brakes on a car. Their purpose is not simply to slow things down; they make speed safer. The same principle applies to AI governance.

Get ahead of shadow AI and emerging agent risk. Work with Sourcepass MCOE to put the right security controls, policies, and oversight in place: https://sourcepassmcoe.com/demystifying-microsoft-contact 

Gabriel Friedland on LinkedIn

Nathan Taylor on LinkedIn

Demystifying Microsoft is handcrafted by our friends over at: fame.so