Notifications
Clear all
Topic starter
14/08/2026 6:36 pm
TL;DR: ChatGPT is creating a new data-loss surface because employees paste source code, customer records, financial models, and internal documents into browser prompts that legacy DLP never sees, according to Orion. The control problem is no longer whether teams will use AI, but whether security can classify and stop sensitive text at the point of entry.
NHIMG editorial — based on content published by Orion: DLP for ChatGPT and how to stop sensitive data leaks
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams stop sensitive data from being pasted into ChatGPT?
A: Start by enforcing at the browser prompt, not just at file upload or network egress.
Q: Why do traditional DLP tools fail on ChatGPT prompts?
A: Because traditional DLP is optimised for files, email, and known egress paths.
Q: What do organisations get wrong about ChatGPT Enterprise security?
A: They often assume account security equals data security.
Practitioner guidance
- Deploy prompt-level DLP at the browser and endpoint Inspect text before it reaches ChatGPT, rather than relying on file, email, or network controls that never see the paste event.
- Classify data by business context, not only regex patterns Teach the control what your organisation treats as sensitive, including source code, customer records, financial models, and internal strategy that may not match standard patterns.
- Separate account governance from content governance Use SSO, retention, and access policies for ChatGPT Enterprise, but do not assume those controls cover prompt content.
What's in the full article
Orion's full article covers the operational detail this post intentionally leaves for the source:
- Browser, endpoint, and SaaS coverage differences for ChatGPT, Claude, Gemini, and Copilot
- How intent and context-based classification is tuned to reduce false positives in production
- Deployment and integration considerations for teams moving from legacy DLP to AI-aware controls
- Examples of how ORION Security applies policy actions such as allow, coach, redact, or block
👉 Read Orion's analysis of ChatGPT DLP and enterprise data leakage →
ChatGPT DLP gaps: what IAM and security teams need to know?
Explore further
14/08/2026 6:42 pm
Browser-paste exfiltration is the new data-loss pattern enterprises have to govern. The article describes a shift from file-centric leakage to prompt-centric leakage, where the risky moment is the paste itself. Legacy DLP assumptions break because the data never traverses the controls that were built for attachment and transfer monitoring. For IAM and security teams, the practitioner conclusion is clear: the policy boundary has moved to the session.
A question worth separating out:
Q: How can teams keep ChatGPT adoption safe without banning it?
A: Use contextual controls that intervene only when the content, user, device, or destination indicates risk. That lets normal work continue while sensitive material is redacted or blocked in the moment. If the policy is too blunt, employees route around it and the organisation loses both visibility and control.
👉 Read our full editorial: ChatGPT DLP gaps leave browser-pasted data exposed
