Topic starter
18/08/2026 2:23 pm
TL;DR: Routine collaboration now drives more insider exposure than obvious misuse, according to Safetica's Data Protection Trends report, with over 60% of blocked activity and policy violations in web apps, email and instant messaging. Data governance has to follow collaboration and AI inputs where sensitive content is created, copied and entered.
Editorial analysis by NHI Mgmt Group, based on content published by Safetica: “Insider Risk Is Becoming Everyday Work Risk”.
Key questions
Q: Why does data-in-use risk rise when employees use collaboration tools and AI apps?
A: Because those tools sit inside everyday work, they become the natural place for people to move information quickly and informally.
Q: What signs show that insider policy is too rigid or too narrow?
A: Look for repeated blocks in ordinary channels, rising use of screenshots or pasted text, and users shifting to different apps after enforcement triggers.
Q: What breaks when insider controls still focus on files instead of data in use?
A: Controls miss the most common modern leakage paths because sensitive content is increasingly copied, pasted, screenshotted or entered into collaboration tools before it becomes a file.
Practitioner guidance
- Map your data-in-use surfaces Inventory where sensitive information is handled in practice, including browser sessions, chat, email, screenshots and AI prompts, then decide which surfaces need inspection and which need restriction.
- Tune policies to role and context Replace uniform rules with controls that consider user role, content type, destination channel and business context so legitimate collaboration does not trigger constant exceptions.
- Govern AI tools as data pathways Treat GenAI interfaces as controlled handling points for sensitive data, with explicit rules for pasted content, screenshots and unmanaged accounts.
Bottom line: Insider risk is increasingly created by ordinary work patterns, not only by clearly malicious behaviour.
Glossary terms: Data In Use, Context-Aware Controls, Channel switching, Insider Risk Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:14 pm
File-centric insider control is now a governance lag, not a governance strategy. The core problem is that security teams still model leakage as document movement, while actual exposure increasingly happens in chat, browser flows, screenshots and AI prompts. That creates a control gap between where policy is written and where work is performed. The practitioner conclusion is straightforward: data governance has to follow the interaction, not just the repository.
A question worth separating out:
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication. Classify sensitive data, define which datasets may enter AI workflows, and monitor outputs, logs, and downstream reuse. If governance stops at login, the organisation can approve access while still losing control of the data itself.
👉 Read our full editorial: Data-in-use risk is shifting insider security beyond documents