In May, Community Bank in Pennsylvania found out an employee had been running customer names, Social Security numbers, and dates of birth through an AI app the bank never approved. Nothing was hacked, but within two days leadership called it material and the parent company filed an 8-K with the SEC. According to American Banker, the bank already had an approved AI tool. The employee used a different one.
Plenty of your clients think AI risk is handled because they bought Copilot or ChatGPT Enterprise. IBM’s 2026 Cost of a Data Breach Report found shadow AI was involved at 43% of the breached organizations it studied, up from 20% the year before.
ECI’s AI Assessment Program is a way back into those accounts. It’s a paid, five-week review of a client’s AI governance, data, and security readiness, and it often leads to ongoing managed work.
When you hear: “We already pay for an enterprise AI tool. We’re covered.”
Ask: “Do you know which AI tools your people are using besides the one you approved?”
