Enterprise AI and SaaS data exposure is driven by user behavior

At a glance

What this is: Bishop Fox reports that routine employee actions in browsers, SaaS apps, and generative AI tools are becoming a repeatable path to sensitive data exposure.

Why it matters: It matters because IAM, PAM, NHI, and broader security programmes now need governance and telemetry at the point of use, not just at the endpoint or perimeter.

By the numbers:

• 45% of employees use generative AI tools, according to Bishop Fox.
• 77% of employees paste data into generative AI tools, according to Bishop Fox.
• 82% of those pastes come from personal, unmanaged accounts, according to Bishop Fox.
• Nearly 40% of uploaded files contain sensitive data such as PII or PCI, according to Bishop Fox.

Context

Enterprise data exposure is increasingly a behaviour problem, not just a tooling problem. When people copy, paste, upload, and prompt from unmanaged browsers and personal accounts, the control gap shifts from the endpoint to the workflow itself. That creates a governance issue for identity, access, and data security teams because the data leaves through legitimate user actions rather than obvious malware.

The article’s core point is that conventional DLP and identity controls were built for older work patterns. Browser-based work, personal SaaS use, and public GenAI tools now create a wider operational surface where policy may exist but enforcement often does not. In practice, that means the organisation needs visibility into how work is actually done, not just where applications are hosted.

Key questions

Q: What breaks when employees paste regulated data into SaaS tools that feed AI features or assistants?

A: The main failure is loss of data boundary control. Even if the SaaS platform is configured correctly, pasted or queried information can be propagated into prompts, model context, logs, or responses. That creates disclosure risk, weakens auditability, and can trigger compliance issues unless browser, endpoint, and integration controls stop the data before it spreads.

Q: Why do unmanaged SaaS and AI tool logins increase IAM risk?

A: Unmanaged logins bypass the identity processes that give teams visibility into access, ownership, and offboarding. Once business users create accounts directly, those credentials can persist beyond role changes or project end dates. That raises both human and non-human identity risk because the organisation cannot reliably apply lifecycle controls to what it cannot see.

Q: What are the signs that browser-based access controls are failing?

A: Warning signs include users reaching sensitive applications from devices with outdated operating systems, missing endpoint protection, or weak encryption settings. Another signal is access being granted without visible policy enforcement or logging when a device falls out of compliance. If security teams cannot consistently block risky sessions and notify IT in real time, the control is not operating as intended.

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Technical breakdown

Why browser-level activity becomes a data loss path

Modern work now happens inside browsers, SaaS consoles, and AI prompts, which means the security boundary has moved from the managed endpoint to the user session. Copy, paste, upload, and prompt actions can move sensitive data into systems that sit outside corporate governance, especially when users switch to personal accounts or unsanctioned services. Traditional DLP often focuses on file movement and static endpoints, so it misses the context of the interaction. The technical problem is not that the tools are exotic, but that they operate in a layer the controls were not built to observe.

Practical implication: Extend monitoring to browser sessions and workflow events, not just devices and files.

Why identity and governance controls must follow the user

Identity tells you who is acting, but it does not by itself tell you whether the action is safe. In this pattern, the risky behaviour happens inside approved access pathways, which makes entitlement checks necessary but insufficient. Organisations need policy that distinguishes sanctioned AI services, corporate SaaS instances, and unmanaged personal accounts, then backs that policy with enforceable control points. That is where identity governance intersects with browser telemetry and application control: the question is not only whether the user is authenticated, but whether the destination, account, and action are allowed in that context.

Practical implication: Bind policy to identity context and destination controls so approved access cannot become unmanaged data sharing.

How offensive testing exposes human-driven leaks

Red teams and penetration testers approach this problem by modelling the same workflows employees use, then looking for where sensitive data can be extracted without exploit development. Prompt leakage, SaaS misuse, and data drift across integrations often reveal paths that static assessments miss because the issue is behavioural and procedural, not purely technical. This is also where human identity and NHI overlap: human users may trigger access to SaaS apps, while underlying tokens, sessions, and integrations quietly carry the data onward. The control challenge is to see those chained actions as one exposure surface.

Practical implication: Test copy, paste, upload, and prompt workflows as attack paths, not just policy violations.

Threat narrative

Attacker objective: The attacker’s objective is to obtain sensitive enterprise data by observing or exploiting normal user workflows rather than breaking perimeter controls.

1. Entry occurs through ordinary browser use, personal SaaS logins, and public AI prompts that employees treat as routine work actions.
2. Sensitive data is then copied, pasted, or uploaded into unmanaged accounts and tools, where it leaves corporate visibility and logging.
3. The impact is persistent exposure of customer records, credentials, PII, PCI, and confidential documents through legitimate-looking user behaviour.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
• Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Human-speed exposure is now a governance problem, not a user-training problem. The article shows that people are not merely the weakest link; they are the operational path through which modern data loss occurs. That changes the control objective from warning users to instrumenting the workflows where copy, paste, upload, and prompt actions happen. Practitioners should treat behaviour as a measurable attack surface, not an abstract compliance concern.

Browser telemetry is becoming a control layer in its own right. When work moves into SaaS and GenAI interfaces, endpoint-centric monitoring no longer provides enough context to judge whether data movement is authorised. The strongest programmes will correlate user identity, session context, destination service, and action type so that governance can follow the interaction rather than the device. Security leaders should expect browser visibility to become part of broader identity and data control design.

Unmanaged accounts create a shadow governance problem that sits alongside Shadow AI. The article’s emphasis on personal, unmanaged accounts shows that exposure often happens outside corporate enforcement even when policy exists. That means discovery, inventory, and control of AI and SaaS usage must become a formal governance workstream, not an ad hoc exception process. Practitioners should assume that unmanaged access paths will persist unless ownership and enforcement are explicit.

Offensive testing needs to model user behaviour, not just attacker tooling. The most useful findings here come from simulating real employee workflows and asking where data leaks through convenience. That is a different test objective from scanning for misconfiguration or malware. Teams should fold browser-based leak scenarios into red-team and control-validation programmes so policy failures surface before they become repeatable exposure patterns.

From our research library:

• Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.

What this signals

Human-speed security is becoming the practical test of modern governance. The problem is no longer whether employees can access AI and SaaS tools, but whether the organisation can see, classify, and control the data they move through them. That shifts the programme from static policy enforcement to continuous workflow governance.

Browser-level visibility will matter more as work decentralises. When copy, paste, upload, and prompt actions become the primary data movement events, endpoint-only control leaves blind spots. Security teams should expect browser instrumentation, application control, and identity context to converge into a single operational view.

Shadow AI and unmanaged accounts are converging into the same exposure problem. The enterprise needs discovery, ownership, and enforcement for both the tools people choose and the accounts they use. Without that, governance remains partial and exposure remains repeatable.

For practitioners

• Define ownership for AI and SaaS risk Assign a named owner for third-party AI tools, SaaS platforms, and cloud services from procurement through monitoring. Cross-functional ownership should include security, IT, legal, and business stakeholders so policy decisions have a clear enforcement path.
• Instrument browser workflows for exposure telemetry Capture copy, paste, upload, and prompt activity at the browser layer so the programme can see where sensitive data moves. Use that telemetry to identify unmanaged accounts, shadow services, and high-risk behaviour patterns.
• Enforce policy with application controls Restrict unapproved platforms through application allowlisting and route approved AI traffic through enterprise-hosted or monitored instances. The objective is to keep visibility and control over sanctioned work paths.
• Test human-driven leak scenarios Add prompt leakage, SaaS misuse, and data drift scenarios to penetration tests and red-team exercises. Model how sensitive information can move through normal productivity workflows without a traditional exploit.
• Measure behavioural risk as a programme metric Track how often sensitive data interacts with unmanaged tools, where AI is used across teams, and how often controls detect or prevent exposure. Translate those measures into governance reporting that leadership can act on.

Key takeaways

• Everyday user actions are now a repeatable enterprise data-loss path because they move sensitive information through browser sessions that older controls do not fully see.
• The report’s figures show that generative AI use, pasting behaviour, and sensitive uploads are common enough to demand governance at the workflow layer.
• Security teams should align identity, browser telemetry, and application control so policy follows the action, not just the device or endpoint.

Key terms

• Browser-Side Data Exposure: The unintentional disclosure of sensitive information through code that executes in a browser session. This can happen through malicious scripts, misconfigured integrations, or legitimate tags that collect and forward more data than the business intended.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Unmanaged Account: An unmanaged account is a login or identity that exists without clear ownership, provisioning records, or offboarding control. In identity programmes, these accounts often sit outside SSO, PAM, and standard recertification processes, making them hard to govern.
• Workflow telemetry: Structured evidence about what happened inside a development or automation workflow, including who invoked a tool, what branch was affected, and whether policy outcomes were met. It is the basis for auditability when humans and agents share the same change path.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and workload identity. It helps practitioners connect identity controls to the broader security programmes that depend on them.