In honor of Halloween, here's a post with some scary stories. Some of these tales come from patterns we run into with growing businesses. Others made international headlines. Every one of them had a happy ending available, if someone had made a few decisions a little earlier.
What are the most common IT horror stories, and how do you avoid them? The most common IT horror stories start with ordinary gaps: untested backups, accounts that outlive employees, unverified payment requests, messy file permissions, and AI tools launched without guardrails. You avoid them by building technology in stages, with stable foundations first, then security, then integration, and only then advanced AI.
Here’s the twist most horror movies save for the end: AI rarely creates your risk from scratch. It amplifies whatever is already there. Clean permissions plus AI means faster work. Messy permissions plus AI means faster leaks.
The numbers back this up. IBM’s 2025 Cost of a Data Breach Report found that one in five organizations had a breach tied to shadow AI (employees using AI tools that IT hasn’t approved or secured). Organizations with high levels of shadow AI paid an average of $670,000 more per breach, and 97% of organizations that suffered an AI-related breach lacked proper AI access controls.1
None of this means AI is too dangerous to touch. It means good AI depends on good IT. The frustrating part for most leaders is that they’re sold the exciting layer without anyone mentioning the foundation underneath it. That’s backwards, and it’s how ordinary companies end up starring in the stories below.
TMM stage: Operate
A server fails on a Monday morning. No panic, because the backup dashboard has shown green checkmarks every night for a year. Then the restore starts, and the files aren’t there. A storage migration months earlier quietly pointed the backup job at an empty folder, and the software kept reporting “success” because, technically, it was backing up exactly what it was told to.
We’ve seen versions of this story more than once, and the plot is always the same: a backup you haven’t restored is a hope, not a plan.
How to avoid it:
For a deeper look at resilience planning, see our guide to storm-tested infrastructure.
TMM stage: Secure
An employee leaves on good terms. Eight months later, their account is still active, still syncing email to a personal phone, still a member of the shared finance folder. Nobody notices until a strange sign-in shows up at 2 a.m. from a country where the company has no staff.
The former employee did nothing wrong. Their password had simply ended up in someone else’s hands, and the account was a door nobody remembered to lock.
How to avoid it:
TMM stage: Secure (with an AI twist)
This one is real, and it’s the story that changed how a lot of finance teams think about video calls. In January 2024, an employee in the Hong Kong office of global engineering firm Arup joined a video conference with what appeared to be the company’s UK-based CFO and several colleagues. Every one of them was AI-generated. Following instructions from that call, the employee made 15 transfers totaling HK$200 million (about £20 million) to five bank accounts.2
Arup confirmed that fake voices and images were used, and said its internal systems were never compromised. That’s the chilling part: nothing was hacked except the process.
How to avoid it:
TMM stage: Integrate
A company rolls out Microsoft 365 Copilot to boost productivity. During the first week, a curious employee asks it to summarize “recent compensation discussions.” Copilot happily obliges, because an HR folder had been shared with the whole company years ago and nobody remembered.
Copilot didn’t break any rules. It respects the permissions you already have. It just made an old mistake instantly searchable. This is one of the most common surprises we hear about during AI rollouts, and it’s entirely preventable.
How to avoid it:
We walk through the full checklist in Preparing Microsoft 365 for Copilot: Your Security-First Guide.
TMM stage: Innovate
A traveler asked Air Canada’s website chatbot about bereavement fares after a death in the family. The chatbot told him he could book now and request the discounted fare afterward. The airline’s actual policy said otherwise, and it refused the refund.
In the dispute that followed, Air Canada argued the chatbot was responsible for its own actions. In February 2024, British Columbia’s Civil Resolution Tribunal disagreed, finding the airline liable for negligent misrepresentation and ordering it to pay the difference, about CAD $650, plus interest and fees.3
The dollar amount was small. The lesson isn’t: you own what your AI tells customers.
How to avoid it:
For guidance on choosing and governing AI tools, see our CEO’s AI governance playbook.
Look closely and you’ll notice a pattern: every story above is a stage that got skipped.
| Horror story | TMM stage | What prevents it |
|---|---|---|
| The Backup That Only Existed on Paper | Operate | Scheduled restore testing and defined recovery targets |
| The Ghost Who Still Had a Password | Secure | HR-linked offboarding, single sign-on, MFA |
| The CFO Who Wasn’t Really on the Call | Secure | Out-of-band verification and dual approval |
| The Copilot That Knew Too Much | Integrate | Permissions cleanup and sensitivity labels before rollout |
| The Chatbot That Wrote Its Own Policy | Innovate | Grounded content, human handoff, ongoing review |
At Sentry, we guide growing businesses through the Technology Maturity Model (TMM): Operate, Secure, Integrate, Innovate. It isn’t about slowing down your AI ambitions. It’s about making sure each stage can carry the weight of the next one. Companies that move through the stages in order don’t avoid AI; they get to it faster, because they aren’t stopping to clean up after it.
If you’ve already read our take on why shadow AI is a leadership problem, this is the other half of that story: governance gives your team permission to use AI, and a mature foundation makes that permission safe.
Fast-forward a year. A server fails, and you’re back up before lunch because your last restore test went fine. Someone leaves the company, and one click closes every door they had. An “urgent” wire request from the CFO gets a quick callback, and the scam dies on the spot.
Your Copilot rollout goes smoothly, because people find exactly what they should and nothing they shouldn’t. Your customer-facing AI answers questions from approved content and hands off the tricky ones to your team. And when your leadership team talks about AI, it sounds like a competitive advantage, not a gamble.
That’s not a fairy tale. It’s what a stage-appropriate roadmap delivers.
Shadow AI is any AI tool employees use for work without IT’s knowledge or approval, such as pasting company data into a free chatbot. It’s usually well-intentioned, but it creates blind spots around where your data goes. The fix is a clear AI policy plus approved tools people actually want to use.
Test a real restore at least quarterly, and after any major change such as a server migration or new software rollout. Backup software reporting “success” only tells you a job ran, not that you can get your data back.
Copilot only shows users content they already have permission to access. The problem is that many organizations have years of overly broad sharing they’ve forgotten about. A permissions review before rollout closes those gaps.
Make verification a process, not a judgment call. Require a callback on a known number for any payment change or urgent transfer, add dual approval above a dollar threshold, and train employees that voice and video can be convincingly faked.
If your backups are tested, your accounts are managed, and your permissions are clean, you’re likely in good shape to start. If you’re not sure, a short assessment against the Technology Maturity Model will show you where to focus first.
You don’t need to fear AI, and you don’t need to figure it out alone. You need a clear plan and a partner who has helped other growing businesses get there without the scary detours.
Ready to explore what AI could do for your business? Book a free AI consultation with our team. [PLACEHOLDER LINK]