AI data security: are your controls keeping up with prompts and agents?

TL;DR: AI is widening data security exposure through prompts, agents, APIs, models and supply chains, while 68% of organisations have already faced AI-related data leaks and only 23% have policies governing employee AI use, according to Mindgard. Legacy DLP and perimeter controls no longer match the speed, privilege and visibility demands of AI-driven workflows.

Editorial analysis by NHI Mgmt Group, based on content published by Mindgard: “AI Data Security Trends: The New Rules for Protecting Sensitive Data”.

By the numbers:

• 68% of organisations have already faced data leaks related to employee use of AI tools, while only 23% have AI security policies that govern employee use.
• 39.7% of total interactions with AI tools include prompt text, copy-paste functions and file uploads that contain sensitive data.
• In 2025, the FBI IC3 received 22,364 AI-related complaints from victims that cost Americans almost $893 million.

Key questions

Q: What breaks when AI data access is not centrally governed?

A: When access is fragmented, teams lose visibility into what data is feeding models, who can change it, and whether outputs can be trusted.

Q: Why do AI agents make excessive access more dangerous than human access?

A: AI agents can use inherited permissions continuously, across multiple systems, and at machine speed.

Q: What are the signs that traditional controls are failing to see shadow AI use in the enterprise?

A: A common sign is that AI activity appears in business outcomes but not in security logs.

Practitioner guidance

• Map AI data paths and trust boundaries Document every place sensitive information can enter, transform, or leave an AI workflow, including prompts, file uploads, agents, plugins, and API calls.
• Scope AI entitlements to the task Remove standing access that is not required for the current use case, and separate read, write, retrieval, and external sharing permissions.
• Block shadow AI and unsanctioned connectors Detect unmanaged AI tools, browser extensions, and third-party integrations, then revoke or isolate anything that bypasses approved identity, logging, or data controls.

Bottom line: AI is expanding the data security problem into prompts, agents, APIs, model pipelines, and supply chains, which makes visibility and access governance the first control challenge.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →