Topic starter
18/08/2026 2:23 pm
TL;DR: More than 60% of blocked activity and policy violations occurred in everyday channels like web apps, email, and instant messaging, while ChatGPT-related blocks surged 86% from Q3 to Q4 and free-form text and screenshots rose in blocked content, according to Safetica’s Data Protection Trends report. The real control problem is moving from file-centric policy to context-aware governance of data-in-use.
Editorial analysis by NHI Mgmt Group, based on content published by Safetica: “Insider Risk Is Becoming Everyday Work Risk”.
Key questions
Q: What breaks when insider controls still focus on files instead of data in use?
A: Controls miss the most common modern leakage paths because sensitive content is increasingly copied, pasted, screenshotted or entered into collaboration tools before it becomes a file.
Q: Why does data-in-use risk rise when employees use collaboration tools and AI apps?
A: Because those tools sit inside everyday work, they become the natural place for people to move information quickly and informally.
Q: What signs show that insider policy is too rigid or too narrow?
A: Look for repeated blocks in ordinary channels, rising use of screenshots or pasted text, and users shifting to different apps after enforcement triggers.
Practitioner guidance
- Map your data-in-use surfaces Inventory where sensitive information is handled in practice, including browser sessions, chat, email, screenshots and AI prompts, then decide which surfaces need inspection and which need restriction.
- Tune policies to role and context Replace uniform rules with controls that consider user role, content type, destination channel and business context so legitimate collaboration does not trigger constant exceptions.
- Govern AI tools as data pathways Treat GenAI interfaces as controlled handling points for sensitive data, with explicit rules for pasted content, screenshots and unmanaged accounts.
Bottom line: Insider risk is increasingly created by ordinary work patterns, not only by clearly malicious behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:14 pm
File-centric insider control is now a governance lag, not a governance strategy. The core problem is that security teams still model leakage as document movement, while actual exposure increasingly happens in chat, browser flows, screenshots and AI prompts. That creates a control gap between where policy is written and where work is performed. The practitioner conclusion is straightforward: data governance has to follow the interaction, not just the repository.
A question worth separating out:
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication. Classify sensitive data, define which datasets may enter AI workflows, and monitor outputs, logs, and downstream reuse. If governance stops at login, the organisation can approve access while still losing control of the data itself.
👉 Read our full editorial: Data-in-use risk is shifting insider security beyond documents