New research commissioned by BlackFog had some eye-opening data points. The “anti-data exfiltration” solution provider found that 47 percent of security decision-makers have acknowledged an incident in which sensitive data was exposed via an AI tool.
This is dangerous territory for retailers, brands and sourcing and supply chain companies that are ramping up investments in AI.
“The findings show how speed is outpacing control, as organizations try to balance rapid AI deployment with the need to protect sensitive data shared in AI tools,” BlackFog said in a statement. “Amongst those organizations that had experienced a data incident, more than three-quarters (77 percent) said a sanctioned, company-approved AI tool was involved.”
The survey was conducted with cybersecurity leaders in the United States and the United Kingdom.
Other findings revealed that 39 percent of respondents reported that AI adoption is moving faster than they can govern it. “And, of those respondents feeling outpaced, only around a quarter (27 percent) have comprehensive AI controls in place,” the report’s authors said.
The research also highlights the lack of visibility that companies have into the types of data that are being shared with AI tools. “While the vast majority of organizations (98 percent) report having an AI usage policy in place, approaches to enforcement vary,” the report stated. “Around a third (35 percent) have a written policy specifying what information employees must not enter into AI prompts, but without technical enforcement.”
BlackFog said of those polled, 56 percent support their broader AI usage policies with comprehensive technical controls.
Digging deeper into the data showed that AI visibility is falling short of what data is shared. Of those polled, 62 percent said they could identify users or departments sending data to AI tools. Of those surveyed, 48 percent said they could provide any record of the types of data that had left the company through AI tools.
But lack of visibility is not the only problem.
The report’s authors said autonomous AI agents present a gap in governance. “More than half, 56 percent, of respondents say autonomous AI agents acting on behalf of employees fall outside their organization’s existing controls, suggesting governance may not yet be keeping pace with the shift from employees using AI tools, to AI acting on their behalf,” they noted.
And when asked about their ability to prevent risky behavior and the types of data shared (such as sales data, proprietary code or IP), only around half of businesses polled said they can technically prevent it.
The research also showed that controls are weakest around employees who share proprietary design, creative or marketing content. “For this type of content, 32 percent of respondents stated that they can detect or monitor, but can’t consistently prevent it, and a further 20 percent stated they rely primarily on written policies or training,” the report said.
“Among organizations that reported sensitive data exposure, 77 percent said a company-approved AI tool was involved,” said Dr. Darren Williams, founder and CEO of BlackFog. “This shows why security teams cannot stop at deciding which AI tools employees are allowed to use. Organizations also need to control what information is shared with them.”
Williams went on to say that written policies set expectations, but they cannot prevent sensitive data from leaving the organization on their own. “Businesses need visibility into the data being shared and technical controls that can stop unauthorized disclosure at the point it happens,” the CEO said. “Those protections need to cover approved AI tools, unsanctioned services and autonomous agents acting on employees’ behalf.”
Click Here For The Original Source.
——————————————————–
