A study run by Toluna at the request of Kaspersky in 2025, based on 2,800 online interviews with employees and business owners in seven countries including Pakistan, found that 86% of professionals use AI tools for work. Only 44.5% had received any training on the cybersecurity aspects of using them. 75% said generative AI tools were permitted at their workplace, 19% said they were not allowed, and 6% did not know what their company's policy was.
One caveat matters before anyone quotes that first number as a Pakistan statistic. The 86% figure is the aggregate across all seven countries surveyed, which were Türkiye, South Africa, Kenya, Pakistan, Egypt, Saudi Arabia and the UAE. The published release does not break results down by country. It is a regional finding that includes Pakistan, not a Pakistan-specific one, and we would rather say that plainly than round it into something more quotable.
Even read conservatively, the shape is clear. Adoption in the workforce has run far ahead of governance in the business, and the gap between the two is where the cost sits.
What is shadow AI, in practical terms?
Shadow AI is the use of AI tools by employees without the knowledge, approval or oversight of the business. It is rarely deliberate concealment. Somebody finds a tool that saves them two hours a week, uses it, tells a colleague, and within months a meaningful share of the company's work passes through software nobody has assessed.
The Kaspersky finding that only 44.5% had security training, while 6% did not know whether AI was even permitted, describes exactly that situation.
Why is individual AI use not the same as business automation?
Because it improves a person's output without changing how the business runs. An employee using an assistant to draft emails is faster at emails. The process around them is unchanged, the time saved is absorbed rather than captured, and nothing about the result is repeatable if that person leaves.
Automation is a different exercise. It means taking a defined process, quote follow-ups, invoice chasing, lead qualification, order confirmations, and building something that runs whether anyone remembers to trigger it. That produces a compounding gain rather than a personal one, and it belongs to the business rather than to whoever discovered the tool.
Most Pakistani businesses have skipped straight to the first and never attempted the second. Our earlier look at how AI automation is saving small businesses 20-plus hours a month covers what the second one looks like when it is done properly.
What does the risk side actually look like?
It is mostly data, not drama. Staff paste client details, pricing, contracts and internal documents into consumer AI tools with no assessment of where that data goes or how long it is retained. For a business handling customer financial information or commercial terms, that is a real exposure, and the survey suggests fewer than half the people doing it have had any training on the subject.
The second risk is quieter and more expensive. Work quality becomes inconsistent because there is no standard. Two people doing the same task with two different tools produce two different outputs, and neither is documented. When something goes wrong, nobody can reconstruct how the output was produced.
Neither risk is an argument for banning the tools. The 19% of workplaces that do not permit them are not safer, they have simply pushed the same behaviour onto personal devices where it is invisible.
Why do businesses stall between the two?
Because the first step is free and the second one requires a decision. Downloading an AI assistant costs nothing and needs nobody's approval. Automating a process means somebody has to describe how that process currently works, admit where it is inconsistent, and agree what the correct version is. That is management work, and it is the part most small businesses avoid.
There is also a sizing error at play. Owners tend to picture automation as a large software project, price it in their head at something unaffordable, and stop. In practice the useful projects are small and specific: one process, one trigger, one measurable outcome. A business that automates enquiry response and nothing else will still see the difference in its pipeline within a month.
The third reason is more sympathetic. Businesses that have been sold technology before, and got a system nobody uses, are rightly cautious. The protection against that is to start from a process the business already runs manually every day, so the success test is obvious: is this now happening without anyone remembering to do it.
What should a Pakistani business do first?
Find out what is already being used. Not as an audit with consequences, as a straightforward question: which tools are you using, for what, and what information goes into them. Most business owners are surprised by the answer, and the exercise costs an afternoon.
Then write one page of policy. Which tools are approved, what data must never be entered into them, and who to ask when something is unclear. One page that people read beats a formal document that nobody opens.
Only then look at automation. With visibility into what people actually do all day, the two or three processes worth automating become obvious, and they are usually not the ones anyone would have guessed.
How should a business measure whether it worked?
With one number chosen before the work starts. Time from enquiry to first reply. Percentage of quotes followed up. Days sales outstanding. Hours a week spent on a named administrative task. Pick the one that reflects the problem and record where it stands today.
Businesses that skip this end up arguing about whether automation helped, because there is nothing to point at. Businesses that write the baseline down get a clear answer within a month, and the answer is occasionally no, which is useful in its own right. A process that was not costing much time will not free up much time when automated.
The measurement discipline also protects against the more common failure, which is building something clever that nobody uses. If the number does not move, the automation is not being used, whatever the dashboard says.
Is automation realistic for a small business in Pakistan?
More realistic than it was, because the cost structure has changed. The processes worth automating in a small business are ordinary ones: responding to enquiries within minutes rather than hours, chasing unpaid invoices on a schedule, qualifying leads before a person spends time on them, following up quotes that went quiet.
None of that requires custom software any more. It requires somebody to map the process honestly and connect tools that already exist. Our AI automation services for businesses in Pakistan start from that mapping rather than from a product, and our AI automation service page sets out what the work involves.
What does a sensible first project look like?
Take enquiry handling, because almost every business has the same problem with it. An enquiry arrives through a form, a WhatsApp message or a social comment. Someone sees it, sometimes quickly and sometimes hours later. There is no record of which enquiries were answered, no follow-up when a conversation goes quiet, and no way to tell at the end of the month how many were lost.
The automated version is unremarkable. Every enquiry lands in one place regardless of channel. An immediate acknowledgement goes out with a realistic response time. Basic qualifying questions are asked before a person is involved. Anything without a reply after two days triggers a follow-up. At month end, the business can see how many enquiries arrived, how many were answered and how many converted.
Nothing in that description is advanced. It is the sort of thing many businesses in the UK and USA have run for a decade, and it remains uncommon among Pakistani SMEs. That gap is the opportunity, and it belongs to whoever closes it first in a given category.
How does this connect to getting more customers?
Directly, through response time. The single most common automation gain we see is not a cost saving, it is that enquiries get answered while the person is still interested. A business that replies in three minutes wins work from a competitor that replies the next morning, regardless of which is better at the job.
That only matters if enquiries are arriving in the first place, which is a separate problem with a separate fix. If your business is not currently visible to people searching for what you sell, automation makes a small number of enquiries slightly better handled. Our digital marketing services in Pakistan address the front of that pipeline, and the method behind it is set out in our guide to digital marketing for accounting firms, which generalises well beyond accountancy.
Triomatic Marketing is an AI-powered, founder-led agency working with businesses across Pakistan, the UK and the USA, and we keep 82% of our clients by being straight about which problem is actually binding.
FAQs
Do 86% of Pakistani professionals really use AI at work?
That figure is a regional aggregate, not a Pakistan-specific one. The Kaspersky and Toluna study covered 2,800 interviews across seven countries including Pakistan, and the published release does not break the 86% down by country. It is accurate as a regional finding that includes Pakistan.
What is shadow AI?
Shadow AI is employees using AI tools for work without the knowledge, approval or oversight of the business. It is usually not deliberate concealment. Someone finds a tool that saves time, uses it, tells colleagues, and company work starts flowing through software nobody has assessed.
What is the difference between AI use and AI automation?
Individual use makes one person faster without changing how the business runs, and the gain leaves when they do. Automation takes a defined process such as invoice chasing or lead qualification and builds something that runs on its own, so the gain belongs to the business and compounds.
Should a business ban AI tools if it has no policy?
Banning tends to push the same behaviour onto personal devices where nobody can see it. The survey found 19% of workplaces prohibit these tools, which does not make them safer. A one-page policy naming approved tools and prohibited data is more effective than a prohibition.
What should a small business automate first?
Usually enquiry response, invoice chasing, lead qualification and quote follow-up. These are ordinary, repeatable processes with clear triggers, and they no longer require custom software. The main requirement is mapping the process honestly before connecting anything.
How does automation help win more customers?
Mostly through response time. A business that replies to an enquiry in minutes wins work from one that replies the next morning, regardless of which does the job better. That only helps if enquiries are arriving, which is a separate visibility problem with a separate fix.