BlackFog survey: 47% of security leaders report sensitive data exposure through AI tools, mostly approved ones
A BlackFog survey of security leaders, published on November 4, found that 47% had experienced sensitive data exposure through an AI tool at their organization. 77% of those incidents involved a company-approved AI tool. Only 48% of respondents could provide a record of the types of data that left the organization through AI tools, although 62% could identify the users or departments sending data. This is survey research, not a specific incident, vulnerability or threat actor campaign.
Detalhes técnicos
- 98% of organizations have an AI usage policy, but only 56% back it with comprehensive technical controls. About 35% have a written policy with no technical enforcement.
- 39% say AI adoption is moving faster than they can govern it. Among those, only 27% have comprehensive AI controls.
- 56% say autonomous AI agents acting on behalf of employees fall outside existing controls. The figure is 70% in technology and telecoms.
- Only 54% can block or restrict unsanctioned AI tools. About 32% can detect shadow AI use but cannot consistently stop it.
Remediação
BlackFog CEO Darren Williams said security teams must control what information is shared with AI tools, not only which tools are allowed. In practice this means technical enforcement such as data-level controls, visibility into the data types leaving the organization, and governance of AI agents.
Linha do tempo
-
BlackFog survey: 47% of security leaders report sensitive data exposure through AI tools, mostly approved ones
ler a análise desta fonte ocultar
A BlackFog survey of security leaders, published on November 4, found that 47% had experienced sensitive data exposure through an AI tool at their organization. 77% of those incidents involved a company-approved AI tool. Only 48% of respondents could provide a record of the types of data that left the organization through AI tools, although 62% could identify the users or departments sending data. This is survey research, not a specific incident, vulnerability or threat actor campaign.
Technical Details
- 98% of organizations have an AI usage policy, but only 56% back it with comprehensive technical controls. About 35% have a written policy with no technical enforcement.
- 39% say AI adoption is moving faster than they can govern it. Among those, only 27% have comprehensive AI controls.
- 56% say autonomous AI agents acting on behalf of employees fall outside existing controls. The figure is 70% in technology and telecoms.
- Only 54% can block or restrict unsanctioned AI tools. About 32% can detect shadow AI use but cannot consistently stop it.
Remediation
BlackFog CEO Darren Williams said security teams must control what information is shared with AI tools, not only which tools are allowed. In practice this means technical enforcement such as data-level controls, visibility into the data types leaving the organization, and governance of AI agents.