The Halloween Edition: 5 IT Horror Stories (and How to Avoid Them)

In honor of Halloween, here's a post with some scary stories. Some of these tales come from patterns we run into with growing businesses. Others made international headlines. Every one of them had a happy ending available, if someone had made a few decisions a little earlier.

What are the most common IT horror stories, and how do you avoid them? The most common IT horror stories start with ordinary gaps: untested backups, accounts that outlive employees, unverified payment requests, messy file permissions, and AI tools launched without guardrails. You avoid them by building technology in stages, with stable foundations first, then security, then integration, and only then advanced AI.

Why Do the Scariest AI Stories Start With Boring IT Problems?

Here’s the twist most horror movies save for the end: AI rarely creates your risk from scratch. It amplifies whatever is already there. Clean permissions plus AI means faster work. Messy permissions plus AI means faster leaks.

The numbers back this up. IBM’s 2025 Cost of a Data Breach Report found that one in five organizations had a breach tied to shadow AI (employees using AI tools that IT hasn’t approved or secured). Organizations with high levels of shadow AI paid an average of $670,000 more per breach, and 97% of organizations that suffered an AI-related breach lacked proper AI access controls.¹

None of this means AI is too dangerous to touch. It means good AI depends on good IT. The frustrating part for most leaders is that they’re sold the exciting layer without anyone mentioning the foundation underneath it. That’s backwards, and it’s how ordinary companies end up starring in the stories below.

What Are the 5 IT Horror Stories (and How Do You Avoid Each One)?

1. The Backup That Only Existed on Paper

TMM stage: Operate

A server fails on a Monday morning. No panic, because the backup dashboard has shown green checkmarks every night for a year. Then the restore starts, and the files aren’t there. A storage migration months earlier quietly pointed the backup job at an empty folder, and the software kept reporting “success” because, technically, it was backing up exactly what it was told to.

We’ve seen versions of this story more than once, and the plot is always the same: a backup you haven’t restored is a hope, not a plan.

How to avoid it:

• Test real restores on a schedule (quarterly at minimum), not just backup jobs.
• Define your recovery time objective (how long you can afford to be down) and recovery point objective (how much data you can afford to lose).
• Keep at least one copy offsite or in the cloud, separate from your main network.

For a deeper look at resilience planning, see our guide to storm-tested infrastructure.

2. The Ghost Who Still Had a Password

TMM stage: Secure

An employee leaves on good terms. Eight months later, their account is still active, still syncing email to a personal phone, still a member of the shared finance folder. Nobody notices until a strange sign-in shows up at 2 a.m. from a country where the company has no staff.

The former employee did nothing wrong. Their password had simply ended up in someone else’s hands, and the account was a door nobody remembered to lock.

How to avoid it:

• Tie offboarding to HR so IT gets notified the same day someone leaves.
• Use single sign-on (one login that controls access to all your apps) so one switch shuts off everything.
• Run quarterly access reviews and require multi-factor authentication on every account.

3. The CFO Who Wasn’t Really on the Call

TMM stage: Secure (with an AI twist)

This one is real, and it’s the story that changed how a lot of finance teams think about video calls. In January 2024, an employee in the Hong Kong office of global engineering firm Arup joined a video conference with what appeared to be the company’s UK-based CFO and several colleagues. Every one of them was AI-generated. Following instructions from that call, the employee made 15 transfers totaling HK$200 million (about £20 million) to five bank accounts.²

Arup confirmed that fake voices and images were used, and said its internal systems were never compromised. That’s the chilling part: nothing was hacked except the process.

How to avoid it:

• Require out-of-band verification for any payment change or urgent transfer. Call back on a number you already have, never one provided in the request.
• Set dual approval for transfers above a set threshold.
• Train your team that voice and video can be faked now, and practice with realistic scenarios. Our guide to running phishing drills that actually train your team is a good place to start.

4. The Copilot That Knew Too Much

TMM stage: Integrate

A company rolls out Microsoft 365 Copilot to boost productivity. During the first week, a curious employee asks it to summarize “recent compensation discussions.” Copilot happily obliges, because an HR folder had been shared with the whole company years ago and nobody remembered.

Copilot didn’t break any rules. It respects the permissions you already have. It just made an old mistake instantly searchable. This is one of the most common surprises we hear about during AI rollouts, and it’s entirely preventable.

How to avoid it:

• Audit file and folder permissions before you turn Copilot on, especially “Everyone” and “anyone with the link” sharing.
• Apply sensitivity labels to HR, finance, and legal content.
• Start with a pilot group, learn what surfaces, then expand.

We walk through the full checklist in Preparing Microsoft 365 for Copilot: Your Security-First Guide.

5. The Chatbot That Wrote Its Own Policy

TMM stage: Innovate

A traveler asked Air Canada’s website chatbot about bereavement fares after a death in the family. The chatbot told him he could book now and request the discounted fare afterward. The airline’s actual policy said otherwise, and it refused the refund.

In the dispute that followed, Air Canada argued the chatbot was responsible for its own actions. In February 2024, British Columbia’s Civil Resolution Tribunal disagreed, finding the airline liable for negligent misrepresentation and ordering it to pay the difference, about CAD $650, plus interest and fees.³

The dollar amount was small. The lesson isn’t: you own what your AI tells customers.

How to avoid it:

• Ground customer-facing AI in approved, current content rather than open-ended answers.
• Build a clear handoff to a human for policy, pricing, and anything with financial consequences.
• Test with real customer questions before launch, and review conversation logs regularly after.

For guidance on choosing and governing AI tools, see our CEO’s AI governance playbook.

How Does the Technology Maturity Model Keep You Out of a Horror Story?

Look closely and you’ll notice a pattern: every story above is a stage that got skipped.

At Sentry, we guide growing businesses through the Technology Maturity Model (TMM): Operate, Secure, Integrate, Innovate. It isn’t about slowing down your AI ambitions. It’s about making sure each stage can carry the weight of the next one. Companies that move through the stages in order don’t avoid AI; they get to it faster, because they aren’t stopping to clean up after it.

If you’ve already read our take on why shadow AI is a leadership problem, this is the other half of that story: governance gives your team permission to use AI, and a mature foundation makes that permission safe.

What Does the Happy Ending Look Like?

Fast-forward a year. A server fails, and you’re back up before lunch because your last restore test went fine. Someone leaves the company, and one click closes every door they had. An “urgent” wire request from the CFO gets a quick callback, and the scam dies on the spot.

Your Copilot rollout goes smoothly, because people find exactly what they should and nothing they shouldn’t. Your customer-facing AI answers questions from approved content and hands off the tricky ones to your team. And when your leadership team talks about AI, it sounds like a competitive advantage, not a gamble.

That’s not a fairy tale. It’s what a stage-appropriate roadmap delivers.

Frequently Asked Questions

What is shadow AI?

Shadow AI is any AI tool employees use for work without IT’s knowledge or approval, such as pasting company data into a free chatbot. It’s usually well-intentioned, but it creates blind spots around where your data goes. The fix is a clear AI policy plus approved tools people actually want to use.

How often should we test our backups?

Test a real restore at least quarterly, and after any major change such as a server migration or new software rollout. Backup software reporting “success” only tells you a job ran, not that you can get your data back.

Can Microsoft Copilot see files employees shouldn’t access?

Copilot only shows users content they already have permission to access. The problem is that many organizations have years of overly broad sharing they’ve forgotten about. A permissions review before rollout closes those gaps.

How can we protect against deepfake payment scams?

Make verification a process, not a judgment call. Require a callback on a known number for any payment change or urgent transfer, add dual approval above a dollar threshold, and train employees that voice and video can be convincingly faked.

Is my business ready for AI?

If your backups are tested, your accounts are managed, and your permissions are clean, you’re likely in good shape to start. If you’re not sure, a short assessment against the Technology Maturity Model will show you where to focus first.

Ready to Make Sure Your AI Story Has a Happy Ending?

You don’t need to fear AI, and you don’t need to figure it out alone. You need a clear plan and a partner who has helped other growing businesses get there without the scary detours.

Ready to explore what AI could do for your business? Book a free AI consultation with our team. [PLACEHOLDER LINK]

References

1. IBM. “IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls.” IBM Newsroom, July 30, 2025. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
2. Dezeen. Report on Arup deepfake video conference scam, May 17, 2024 (citing Arup statement to the Financial Times). https://www.dezeen.com/2024/05/17/arup-victim-deepfake-video-scam/
3. Manatt, Phelps & Phillips. “AI Gone Wild: Airline Has to Honor a Refund Policy Its Chatbot Fabricated.” February 28, 2024, discussing Moffatt v. Air Canada, 2024 BCCRT 149. https://www.manatt.com/insights/newsletters/advertising-law/ai-gone-wild-airline-has-to-honor-a-refund-policy