Topic starter
02/08/2026 9:47 am
TL;DR: Employees input sensitive data into AI tools once every three days on average, yet most events never trigger legacy DLP rules because copy-paste, browser uploads, embedded copilots, and personal accounts sit outside file-transfer assumptions, according to Cyberhaven Labs research. Legacy DLP is no longer enough when data moves through prompts and agentic workflows instead of discrete attachments.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “How to Prevent Data Leakage to GenAI Applications”.
Key questions
Q: What breaks when legacy DLP is used for GenAI tools?
A: Legacy DLP breaks because it assumes data leaves through discrete file-transfer events such as attachments and sanctioned uploads.
Q: Why do personal AI accounts create so much risk in enterprise environments?
A: Personal accounts bypass enterprise identity controls, so security teams lose visibility into who authorised access, what scopes were granted, and whether the session can be revoked.
Q: How can security teams tell whether GenAI data protection is actually working?
A: Teams should measure whether they can see the source, destination, and sensitivity of data before it reaches the AI tool.
Practitioner guidance
- Deploy endpoint-level GenAI observability Capture copy, paste, browser upload, and tool submission events at the endpoint so GenAI interactions are visible even when no file transfer occurs.
- Classify data by lineage Use source-document provenance to extend sensitivity labels into prompts and uploads, rather than relying only on text pattern matching inside the AI tool.
- Tier AI tools by risk Separate sanctioned, tolerated, and unapproved AI tools based on sensitive-data exposure, account type, and whether the tool trains on submitted content.
Bottom line: Legacy DLP is mismatched to GenAI because it was built to inspect file transfers, not prompts, browser uploads, or embedded copilots.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:39 pm
Legacy DLP is failing because it still thinks in files, not in sessions. The central governance gap is that prompts, browser uploads, embedded copilots, and agent outputs do not behave like attachments. Once security teams accept that data movement is now conversational and interface-driven, the control model has to shift from destination-based blocking to source-aware governance. Practitioners should stop treating GenAI leakage as an edge case and start treating it as the new default data path.
A few things that frame the scale:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), contradicting the assumption that private repos are safe, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between GenAI data leakage controls and general AI security?
A: GenAI data leakage controls focus on stopping sensitive enterprise information from entering prompts, uploads, and agent flows. General AI security is broader and also covers model risk, tool inventory, third-party dependencies, and agent governance, so the two areas overlap but do not solve the same problem.
👉 Read our full editorial: Data leakage to GenAI tools exposes a DLP blind spot