Insider risk is shifting into trusted workflows and AI tools

At a glance

What this is: This Safetica report shows insider risk shifting into trusted productivity suites, AI tools, screenshots, and removable media rather than only obvious exfiltration paths.

Why it matters: For IAM, PAM, and broader security teams, it matters because routine collaboration channels now behave like sensitive data movement paths that require role-aware, context-aware governance.

By the numbers:

• In Q4 2025, ChatGPT represented 20.1% of blocked AI tool activity, while Read.ai reached 15.4%.
• The top policy violation channels in Q4 were web apps at 20.6%, email at 20.5%, and instant messaging at 19.8%.
• External USB accounted for 36.1% of unusual activity triggers in Q4.
• Email represented 72.2% of threat-level warning path types in Q4.

👉 Read Safetica's Data Protection Trends report on insider risk and data movement

Context

Insider risk is increasingly a data governance problem inside approved tools, not just a matter of blocking clearly malicious activity. In this case, the primary keyword is insider risk, and the article argues that sensitive data is moving through browser sessions, web apps, messaging, AI tools, screenshots, and USB in ways that traditional DLP assumptions do not fully capture.

That shift matters for identity and access governance because routine work now depends on context-aware control rather than simple application allowlists. Where users are permitted to work, the programme needs to understand who is moving data, in what role, through which channel, and with what sensitivity attached to the content.

Key questions

Q: How should security teams govern AI-powered insider threats?

A: Treat AI-powered insider threat as an identity governance problem first. Track human users, machine identities, and AI-assisted workflows together, then apply ownership, approval, and logging to each access path. Deepfakes and model access only become dangerous when the organisation cannot verify who acted, what credentials were used, and whether the action stayed within scope.

Q: Why do screenshots and plain text files matter in insider risk programmes?

A: Because they often indicate that users are repackaging sensitive information to bypass controls or to move it through a channel the policy does not understand. If a programme only watches documents leaving the organisation, it will miss the behavioural shift into screenshots, text snippets, and other low-friction formats.

Q: How can security teams tell whether DLP is actually reducing risk?

A: Look for better prioritisation of high-value data, fewer noisy alerts, and clearer visibility into which identities can reach sensitive content. If the programme still depends on blocking events at the edge, it is probably measuring activity rather than reducing exposure.

Q: What is the difference between blocking a channel and governing data movement?

A: Blocking a channel is a blunt control that stops one route. Governing data movement means understanding which users, content types, and workflows are acceptable across all the places work happens, so the organisation can reduce risky handling without forcing people into another workaround.

Technical breakdown

Why trusted productivity ecosystems now carry insider risk

Productivity suites, cloud apps, chat platforms, and browser-based work now function as data movement layers, not just business tools. The control problem is that sensitive content can move inside approved channels without ever looking like classic exfiltration. That makes simple perimeter blocking less effective and shifts the burden to policy decisions that understand role, context, and data sensitivity. In practice, the same workflow may be benign for one user and high risk for another. Visibility must therefore focus on behavior, not just destination categories.

Practical implication: map controls to workflow context, not only to application names.

How AI tools change the data-in-use problem

AI tools complicate data protection because users often submit free-form prompts, pasted text, and copied fragments rather than discrete files. Traditional DLP systems were built around documents and metadata, so they can miss the actual data handling event when content is transformed before it leaves the endpoint. When activity concentrates in a few AI platforms, governance can become more targeted, but only if teams classify the inputs, outputs, and acceptable use cases. The real issue is not whether AI is allowed, but what data is being processed in the interaction.

Practical implication: govern prompt and paste behavior as a data control surface.

Why screenshots, text files, and USB are behavioral signals

The rise of .txt and .png files, plus external USB activity, signals repackaging behavior. Users may convert protected material into plain text, capture screenshots to bypass copy restrictions, or move data through removable media when normal collaboration paths feel constrained. These actions are not automatically malicious, but they are strong indicators that policy friction or intentional evasion is present. Good detection should correlate repeated attempts across channels, because the same user intent often shifts from one medium to another as controls tighten.

Practical implication: treat screenshots, text exports, and USB use as multi-channel escalation indicators.

NHI Mgmt Group analysis

Insider risk is becoming a workflow governance issue, not a perimeter problem. When web apps, email, chat, and AI tools become the main movement paths, the question is no longer whether an app is trusted. The question is whether the organisation can apply differentiated rules to trusted tools based on identity, role, and data type. That is a control design issue, not an endpoint-only problem. Practitioners should read this as a push toward contextual policy enforcement.

Data-in-use is the named concept this report sharpens. Sensitive information is increasingly handled as pasted text, screenshots, copied fragments, and browser interactions rather than as intact files. That breaks assumptions in traditional DLP programmes and creates a governance gap between what is stored and what is actually processed. The implication is that data protection must follow the interaction, not just the object. Practitioners should redesign monitoring around usage behaviour.

Channel switching shows that users adapt when controls are too rigid. If email pressure drops while IM or web activity rises, the programme is not reducing risk so much as relocating it. That makes measurement cross-channel, not channel-specific. The lesson for security teams is to detect the same underlying movement pattern across collaboration surfaces, or policies will simply displace the behaviour elsewhere.

Insider governance now intersects with identity governance wherever role and context decide data handling. This is where IAM adds value beyond access approval: the identity layer can inform which data movement behaviours are acceptable for which populations, especially in high-risk roles. That aligns with NIST Cybersecurity Framework 2.0 and broader access-control thinking. Practitioners should link identity signals to data handling rules.

Encrypted collaboration channels deserve closer scrutiny because they compress visibility. When users shift into encrypted messaging or remote-access style workflows, review gets harder and response becomes slower. The report’s pattern suggests that teams need better telemetry across approved and semi-approved channels, not just stronger bans. Practitioners should assume risk migrates to the least visible channel available.

What this signals

The practical lesson for security programmes is that insider risk tooling has to evolve from channel blocking to interaction governance. If your controls cannot distinguish a legitimate business screenshot from repeated sensitive repackaging, then your detection model is already behind the way work actually happens.

Data-in-use governance: this is the control gap the report most clearly exposes, because content is now being handled in browser sessions, chat threads, and AI prompts rather than only in documents. That means security teams should align their policy design with NIST Cybersecurity Framework 2.0 and related access-control thinking, then measure whether the same risky behaviour migrates when one channel is restricted.

For practitioners

• Map sensitive-data movement across approved channels Inventory where confidential data actually moves across browser, web apps, cloud storage, email, chat, AI tools, screenshots, and USB, then apply the same policy logic where the work occurs. Start with the highest-risk roles and compare behaviour across channels to find blind spots.
• Treat AI prompts and pasted text as governed inputs Classify AI tools as data-handling workflows, then define what content can be pasted, summarised, or generated in each population. Build rules for sensitive categories, not only for app allowlisting, and monitor for repeated submissions that indicate policy bypass.
• Correlate screenshots, text files, and USB use Use one detection view for .txt creation, screenshot activity, and external USB events so the same user behaviour can be tracked across repackaging paths. This is the fastest way to spot attempts to move content after a primary channel is restricted.
• Review role-aware policies for collaboration tools Check whether different roles have different permissions for email, instant messaging, web upload, and removable media. The objective is not blanket blocking, but limiting sensitive movement by role, business need, and content type.
• Watch for policy displacement across channels Measure whether blocking one path causes activity to shift into another, especially from email into chat or from file transfer into screenshots. A good control programme reduces risky movement rather than simply redistributing it.

Key takeaways

• Insider risk is shifting into trusted collaboration tools, which makes context-aware policy more important than simple blocking.
• The strongest signals are no longer only documents leaving the environment, but text, screenshots, chat, AI prompts, and USB activity.
• Security teams should measure whether controls reduce risky movement or merely push it into a different channel.

Key terms

• Data In Use: Data in use is information being actively accessed, processed, or modified by a user, application, or workload. It is the hardest state to govern because policy must follow live identity behaviour, not just storage location or network transit.
• Channel Switching: Channel switching is the tendency for users to move the same behaviour from one communication path to another when controls tighten. In insider risk programmes, it is a useful indicator that policy pressure is changing the route, not necessarily reducing the underlying risk.
• Role-Aware Policy: Role-aware policy is a control approach that changes allowed actions based on a person's job function, sensitivity of the data, and operational context. It is more precise than broad allow or deny rules because it can separate legitimate collaboration from high-risk movement.

What's in the full report

Safetica's full report covers the operational detail this post intentionally leaves for the source:

• Quarter-over-quarter channel breakdowns showing where blocked activity is actually rising across the environment
• Policy violation tables for web, email, instant messaging, and USB that help teams compare channel pressure
• App-category and file-extension trend data that show how users repurpose content in practice
• Behavioural observations that help security teams distinguish friction from intent

👉 The full Safetica report includes the trend tables, blocked-activity breakdowns, and behavioural indicators behind these findings.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners build the governance discipline needed to manage identity risk across modern security programmes.