Around half (47%) of security leaders have experienced sensitive data exposure through an AI tool at their organization, research by BlackFog has found.
Of these incidents, 77% involved a company-approved AI tool.
The researchers said the findings demonstrate that many organizations lack visibility into the types of data being shared with AI tools, even those that are approved for use in the enterprise.
While 62% of respondents could identify users or departments sending data to AI tools, less than half (48%) said they could provide any record of the types of data that had left the organization through AI tools.
“This shows why security teams cannot stop at deciding which AI tools employees are allowed to use. Organizations also need to control what information is shared with them," commented Darren Williams, founder and CEO of BlackFog.
Almost all organizations (98%) reported having an AI usage policy in place. However, the ability to enforce such policies varied significantly.
Just over half (56%) support their broader AI usage policies with comprehensive technical controls. Around a third (35%) said that while their organization has a written policy specifying what information employees must not enter into AI prompts, there is no technical enforcement.
Meanwhile, 39% of security leaders admitted that AI adoption is moving faster than they can govern it. Of those respondents feeling outpaced, just 27% have comprehensive AI controls in place.
AI Agents Fall Outside of Organizations’ Governance Strategies
The BlackFog research, published on November 4, also highlighted a significant governance gap around AI agents operating in organizations’ environments.
Over half (56%) revealed that autonomous AI agents acting on behalf of employees fall outside their organization’s existing controls.
Read now: Unchecked AI Agents Cause Cybersecurity Incidents at Two Thirds of Firms
Technology and telecoms were the industries where this issue was most prevalent, with 70% of respondents stating that autonomous AI agents were outside of organizational controls.
In addition, only 54% of security leaders said they had the ability to block or restrict unsanctioned AI tools and around a third (32%) are able to detect shadow AI use but are unable to consistently stop it.