Nearly half of security leaders have seen sensitive data exposed through an AI tool at their organization, according to research by BlackFog. The firm found that 47% of respondents had experienced such an exposure.
Of those incidents, 77% involved a company-approved AI tool, the report said.
BlackFog researchers said the findings show many organizations lack visibility into what data is shared with AI tools, including approved ones. While 62% of respondents could identify the users or departments sending data to AI tools, less than half (48%) could provide any record of the types of data that left the organization through those tools.
"This shows why security teams cannot stop at deciding which AI tools employees are allowed to use. Organizations also need to control what information is shared with them," said Darren Williams, founder and CEO of BlackFog.
The report said 98% of organizations have an AI usage policy. Enforcement varied, however. Fifty-six percent support their policies with comprehensive technical controls. About a third (35%) have a written policy on what employees must not enter into AI prompts but no technical enforcement.
Thirty-nine percent of security leaders said AI adoption is moving faster than they can govern it. Of those, 27% have comprehensive AI controls in place.
The research, published November