"This shows why security teams cannot stop at deciding which AI tools employees are allowed to use. Organizations also need to control what information is shared with them," commented Darren Williams, founder and CEO of BlackFog.
Scope: nearly half of security leaders report sensitive-data exposure through AI
Research published by BlackFog on November 4 finds that 47% of security leaders have experienced sensitive data exposure through an AI tool at their organization. The survey frames the problem as widespread: almost one in two security teams have confronted at least one incident where data flowed out of the enterprise via an AI interface.
Approved tools implicated in most incidents
Of those incidents, 77% involved a company-approved AI tool. That figure underscores a particular vulnerability: sanctioned services and platforms, not only shadow deployments, are where significant leakage has been observed.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildVisibility and recordkeeping gaps inside organizations
BlackFog’s respondents reported uneven ability to trace how and what they are losing. While 62% said they could identify users or departments sending data to AI tools, fewer than half (48%) said they could provide any record of the types of data that had left the organization through AI tools. The study thus separates user-level detection from substantive recordkeeping about exposed data types.
Autonomous AI agents fall outside many governance strategies
The research highlights a distinct governance gap around autonomous AI agents that act on employees’ behalf. Over half (56%) of respondents revealed such agents fall outside their organization’s existing controls. The problem was especially acute in technology and telecoms, where 70% of respondents said autonomous AI agents were outside organizational controls.
Policy presence contrasts sharply with enforcement capabilities
Almost all organizations in the survey (98%) reported having an AI usage policy in place. Yet the ability to enforce those policies varies markedly. Just over half (56%) support their broader AI usage policies with comprehensive technical controls. Around a third (35%) said they have a written policy specifying what employees must not enter into AI prompts but lack technical enforcement to make that rule binding.
Meanwhile, 39% of security leaders admitted that AI adoption is moving faster than they can govern it. Among that subset who feel outpaced, only 27% have comprehensive AI controls in place. Detection and blocking capabilities are also limited: 54% said they have the ability to block or restrict unsanctioned AI tools, and roughly a third (32%) said they can detect shadow AI use but are unable to consistently stop it.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams — face mixed detection and recordkeeping: 62% can identify the users or departments sending data to AI tools, but only 48% can provide records of the types of data that left the organization. And 39% say adoption outpaces governance, with only 27% of those feeling outpaced reporting comprehensive controls.
- Procurement and enterprise leaders — should note that sanctioned solutions are not automatically safe: 77% of exposures involved company-approved AI tools, while only 56% of organizations back policies with comprehensive technical controls and 35% rely on written rules without enforcement.
- End users and employees — are operating under near-universal written policy (98%), yet that policy often lacks the technical teeth to prevent data loss; autonomous agents that act for users are outside controls in 56% of organizations and in 70% of tech and telecom respondents.
BlackFog’s data draws a clear throughline: organizations overwhelmingly have rules about AI use, but a substantial portion do not have the visibility or technical enforcement to prevent sensitive data from leaving the enterprise—often via tools the organization itself approved. The research leaves a practical question with immediate force for security teams and procurement leaders alike: if sanctioned AI tools are implicated in most incidents, strengthening policy means pairing that policy with technical controls and recordkeeping that can show what, when, and how data leaves the network.
Source: https://www.infosecurity-magazine.com/news/security-data-exposure-ai/
