Chatgpt security: are your data controls keeping up?

TL;DR: Enterprises often focus on ChatGPT outputs, but Protecto argues the bigger risk is what employees submit before generation, including customer data, source code, legal documents and strategic plans; Gartner says more than 40% of AI-related data breaches by 2027 will come from generative AI misuse across organizational boundaries. The control problem is data governance, not model quality, because prompts can move sensitive information beyond approved boundaries faster than existing oversight can track it.

Editorial analysis by NHI Mgmt Group, based on content published by Protecto: “ChatGPT Security Risks for Enterprises: Real Incidents, Controls and Best Practices”.

By the numbers:

• More than 40% of AI-related data breaches by 2027 will be caused by the misuse of generative AI across organizational boundaries, according to Gartner.

Key questions

Q: What is the biggest enterprise risk in using ChatGPT with business data?

A: The biggest risk is not the model output, but the data employees expose when they paste confidential material into prompts, uploads or connected apps.

Q: Why do AI data breaches often start with ordinary user behaviour?

A: Because employees often treat AI prompts like a private workspace, even when the system sits outside normal enterprise controls.

Q: How should security teams govern shadow AI without slowing adoption?

A: Start with continuous discovery, then classify tools by data access, system connectivity, and provider trust.

Practitioner guidance

• Define acceptable data classes for AI use Specify exactly which data employees may never paste into public or unmanaged AI tools, including source code, customer data, legal documents and strategic plans.
• Classify and mask sensitive data before submission Apply detection and masking to prompt text, uploaded documents and embedded content before it leaves approved environments, rather than relying on user judgement alone.
• Tie AI access to enterprise identity and logging Use approved identities, session logging and role-aware access so every AI interaction can be traced back to an accountable user and business purpose.

Bottom line: The article frames ChatGPT security as a governance issue rooted in what employees submit, not only in what the model returns.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →