47% of security leaders saw data go out through an AI tool

BlackFog, a security company, published research on 4 November. It says that 47% of security leaders have seen sensitive data go out of their organization through an AI tool. Only 48% can give a record of the types of data that went out. The source gives no count of the persons who took part in the survey.

The policy gap

Almost all organizations (98%) have an AI use policy. Only 56% add full technical controls to it. In 35% there is a written rule on the data that staff must not put in AI prompts. No technical control makes staff obey it.

AI agents

AI agents are software that does tasks for staff with no person at each step. In 56% of organizations, they are not in the controls of the firm. In technology and telecoms firms 70% of them are in this group.

What is not known

The source gives no sample size, no method and no record of the countries. It does not show how much data went out or if it caused injury. Darren Williams, the chief executive of BlackFog, says that firms must control which data staff send to AI tools, not only which tools they use.

Insight: Rules exist, but the owner of the rules is unclear

A report of IANS and Artico Search, on 20 October, found this. The chief information security officer is the primary owner of AI governance at only 7% of large firms. BlackFog finds that 98% have a policy but only 56% add technical controls to it. This reads as a missing owner: the rules are written, but the team that can apply them seems not to be the owner. Name the owner first.