Shadow AI and Smart Risk: Navigating Enterprise Innovation with Lianne Appelt of Salesforce

In a recent episode of Brick by Brick, host Jason Reichl sits down with Lianne Appelt, Enterprise Risk Management Lead at Salesforce, to explore the emerging challenge of "Shadow AI" and how organizations can balance innovation with security. Lianne shares her decade-long journey in risk management, her approach to enterprise-wide risk governance, and actionable strategies for managing AI adoption safely.
‍

‍

To find out how TrustLayer manages risk so that people can build the physical world around us, head to TrustLayer.io.

‍

The rapid adoption of AI tools has created an unexpected risk: employees using unauthorized AI platforms that could expose sensitive company data. This phenomenon, known as "Shadow AI," represents one of the most pressing challenges facing enterprise risk managers today.

‍

"Shadow AI is basically describing a situation where you have employees using AI in a way that can put your company at risk or the AI technology itself is not effective and is potentially exposing you because it's not correct." — Lianne Appelt

‍

Lianne emphasizes that while organizations want to encourage AI adoption and upskill employees, they must do so safely without creating new vulnerabilities.

Risk-Specific Appetite Management

Unlike traditional enterprise risk approaches that rely on broad organizational statements, Lianne advocates for a more nuanced strategy. Her framework assigns specific risk appetites to different business areas:

Higher Risk Tolerance:

• Innovation and product design
• Technology development and capabilities
• Creative processes that drive competitive advantage

Lower Risk Tolerance:

• Financial management and reporting
• Regulatory compliance
• Data security and privacy protocols

"We're not gonna be taking the same amount of risk in different areas throughout the company. In tech we're very innovative, so in innovation and product design, we're gonna be much more risky, open to risk than in our financial management, in our regulatory space." — Lianne Appelt

The Internal AI Solution

To combat Shadow AI risks, Salesforce has implemented a comprehensive strategy centered on providing protected internal alternatives:

Provide Protected Tools:

• Deploy enterprise-grade AI platforms with built-in security controls
• Integrate AI capabilities within existing trusted systems (like Google Suite)
• Ensure internal tools match the convenience of public AI platforms

Implement Governance Framework:

• Establish clear policies around AI usage and data handling
• Create training programs that educate employees on appropriate AI applications
• Build awareness around the risks of external AI tools

Maintain Human Oversight:

• Require human verification of all AI outputs for accuracy and bias
• Establish controls while acknowledging human tendencies to find workarounds
• Focus on ethical considerations and data validation

"You have to make sure that it is accessible and that they know how to use it and where it is... that training and policy and governance around that is crucial." — Lianne Appelt

‍

The Innovation Imperative

Perhaps most importantly, Lianne warns that avoiding AI altogether poses the greatest risk of all. In today's competitive landscape, organizations that fail to adopt AI risk being disrupted by more agile competitors.

‍

"Avoiding the risk altogether is not really an option... we're in a huge innovation transformation space where it's easy to get disrupted now." — Lianne Appelt

‍

The key is maintaining a clear vision while building customer trust and accelerating AI capabilities responsibly.

Managing AI Across the Enterprise

Lianne's approach extends beyond internal usage to encompass the entire business ecosystem:

Customer Education:

• Help customers understand how to use AI ethically and effectively
• Provide training similar to previous cloud security education initiatives
• Build trust through transparency and education

Third-Party Risk Management:

• Apply the same governance standards to vendors and partners
• Ensure AI implementations across the supply chain meet security requirements
• Maintain oversight of customer AI implementations that could impact your organization

Acquisition Integration:

• Develop comprehensive M&A playbooks for AI risk assessment
• Address cultural mismatches when integrating AI-forward startups
• Balance innovation culture with enterprise security requirements
  
  
  
  

The Future of AI Risk Management

As the AI landscape continues evolving, Lianne predicts that successful organizations will be those that embrace AI while maintaining robust governance frameworks. Key trends include:

• Specialized AI Risk Teams: Dedicated professionals focused on AI governance and oversight
• Continuous Adaptation: Regular review and refinement of AI policies as technology evolves
• Cultural Integration: Fostering innovation cultures that naturally incorporate risk management principles
  
  
  

Final Thoughts:

Shadow AI represents both a significant challenge and an opportunity for forward-thinking organizations. By providing secure internal alternatives, implementing comprehensive governance frameworks, and maintaining human oversight, companies can harness AI's transformative power while protecting their most valuable assets.

‍

Lianne's insights demonstrate that the future belongs to organizations that can balance innovation velocity with intelligent risk management—those that embrace AI strategically rather than reactively.

‍

To learn more about how enterprise risk management is evolving in the age of AI, tune in to this episode of Brick by Brick.

‍