The past two years have seen unprecedented adoption of generative AI. This was driven largely by LLM platforms such as Claude, which reported 28 million paying US customers in March.
Senior VP of Engineering at Vanta.
In the corporate world and startups, this has put the pressure on companies to invest in AI, to keep up with the latest models and bolster productivity and efficiency. But now that the world has adopted AI, a stark readiness gap is emerging as governance and AI skills lag behind. AI fluency is now a baseline expectation for employees as leaders feel the pressure to prove the returns on their hefty investments.
Tokenmaxxing is the latest AI trend to come under fire as businesses want employees to use more AI in their work. In essence, this means boosting AI input to maximize AI output. On the surface, it sounds efficient and harmless. But underneath, it poses major security risks.
Tokenmaxxing explained
So what actually is tokenmaxxing?
A ‘token’ is a unit of data processed by an AI model. For example, a word or character inputted into an LLM search. So ‘tokenmaxxing’ quite simply means over-engineering generative AI prompts to get the most out of one search input. This can be anything from overly detailed prompts, to overloading an LLM chat with information, to asking an AI model for step-by-step breakdowns, as opposed to short summaries.
The trend is driven by businesses as leaders face pressure to prove the ROI of AI. It became a tongue-in-cheek benchmark of AI performance. Some companies, such as Meta, even gamified tokenmaxxing, measuring and ranking AI usage and citing the highest scorers ‘Token Legends’.
Their assumption is that AI usage means being AI-forward. But instead, companies need to consider the value they get from AI tools. They also need to keep security at the center of the conversation.
The hidden costs of tokenmaxxing
Although it might look like harmless corporate showboating, this trend poses a wide range of security risks given that LLM vendors are 52% more likely to be designated as “high risk” than traditional SaaS. This is due to access to sensitive data, IP, and internal workflows, so it’s imperative that businesses have oversight of how employees use these resources.
Rapid adoption of AI has led to an experimentation mindset. This is a positive shift from an innovation standpoint, but from a compliance perspective, a ‘trial and error’ approach is more error than trial.
The legacy tech systems most major enterprises are still reliant on are controlled by procurement and security teams and were not designed for the agility of AI technology. Meaning both innovation and compliance are lagging behind. It’s the latter that’s causing major concerns in the cybersecurity world.
When employees face mounting pressure to get the job done, they won’t wait for security teams to approve new tools, which results in shadow AI. This is where unmanaged, unapproved AI tools operate inside company environments without oversight.
Industry data shows that 70% of 16k cybersecurity customers currently have some form of shadow AI lurking within their organization, largely due to AI tools introduced through improper procurement channels that now have access to company data without oversight or guardrails.
There’s also been a 36% increase in shadow IT year-on-year, with organizations discovering, on average, around 140 Shadow IT tools accessing their environment within 90 days of connecting to the platform.
The bottom line is that AI adoption is drastically outpacing governance, and employees are prioritizing speed over control.
How businesses can defend against Shadow AI
The core issue isn’t tokenmaxxing itself; it’s businesses' inability to keep up with employee demand for speedy access to the latest AI tools. This ultimately results in friction between the desire to safely onboard new tools and the ongoing pressure to use AI.
When security teams intervene and revoke access to unmanaged tools, employees just reinstall them. Industry data finds that within a 30-day period, the average enterprise sees employees reinstall revoked tools 100+ times. Within one year, it happens 1,000 times.
To bolster defenses, organizations must design their procurement systems to match the speed of AI innovation, so they can keep up with the rate of AI usage, as demonstrated by so-called ‘token legends’.
Three actions businesses can take now
The more generative AI gets adopted in the corporate world, the more employees will face pressure to adopt and prove its ROI. Tokenmaxxing is just one hype within this wider picture. Businesses need to act fast to stop the gap between experimentation and control widening.
Three things leaders and compliance teams can kickstart today to bolster defenses against shadow AI are:
- Shrinking vendor review timelines so they match the speed of AI adoption
- Set up continuous monitoring systems to detect threats caused by tokenmaxxing before they jeopardize safety
- Implement employee training and policies for AI usage to ensure employees don’t expose sensitive data or IP
The new mandate is matching speed with governance, and it’s up to security teams to lead the charge.
We've featured the best AI chatbot for business.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit