Notifications
Clear all
Topic starter
18/08/2026 2:32 pm
TL;DR: AI assistants, agentic browsers, and automation platforms are creating new data loss paths because employees can paste sensitive information directly into browser-based workflows, according to Seraphic. The control problem is no longer file movement alone, but real-time governance of prompts, responses, and third-party AI interactions.
NHIMG editorial — based on content published by Seraphic: AI-driven data loss protection for the AI-enabled workplace
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams stop GenAI systems from leaking sensitive data?
A: Security teams should combine runtime policy enforcement, semantic detection, and identity-aware access checks.
Q: Why do legacy DLP tools struggle with AI workflows?
A: Legacy DLP was built for files, email, and pattern matching, not for free-form prompts, embedded copilots, or agentic connections.
Q: What do organisations get wrong about AI identity risk?
A: They often focus on the model and ignore the access path.
Practitioner guidance
- Implement browser-level data controls Inspect prompts, pasted text, and responses in-session so policy decisions happen before data reaches external AI services or unmanaged destinations.
- Define context-aware AI data classifications Mark content by business context, not just sensitivity labels, so the control can distinguish safe usage from risky reuse in GenAI and agentic workflows.
- Block unsanctioned AI destinations for sensitive data Create allowlists for approved AI tools and prevent confidential material from being submitted to unknown or third-party platforms that fall outside governance.
What's in the full article
Seraphic's full post covers the operational browser control detail this analysis intentionally leaves for the source:
- In-browser monitoring mechanics for prompts, responses, and user activity across AI tools
- Context-aware policy examples for blocking specific data types from AI destinations
- Real-time detection and response workflow details for suspicious AI interactions
- Practical implementation guidance for using a secure enterprise browser in production
👉 Read Seraphic's analysis of AI-driven data loss protection in browser workflows →
AI workflows and data loss protection: where endpoint DLP falls short?
Explore further
18/08/2026 3:19 pm
AI data loss is becoming a session governance problem, not just a file protection problem. Endpoint DLP still matters, but it was built around document movement and known exfiltration channels. Browser-based AI tools move the risk into prompts, chat responses, and contextual reuse, which means the control point must shift closer to the interaction. The security programme implication is clear: identity, policy, and content controls now need to converge at the browser boundary.
A question worth separating out:
Q: Who is accountable when employees use private AI for work tasks?
A: Accountability usually sits with the organisation that sets policy, the manager who approves the workflow, and the teams that control endpoint and identity settings. If no one defines approved use, the result is shadow AI with weak traceability. The right answer is explicit ownership, not assumed privacy.
👉 Read our full editorial: AI use is exposing data loss gaps that endpoint DLP misses
