Topic starter
14/07/2026 4:24 pm
TL;DR: Financial services teams are using GenAI to accelerate coding, research, and internal app delivery, but Proofpoint says shadow AI, misconfigured Microsoft 365 permissions, and third-party integrations are creating new data leakage paths that security leaders cannot ignore. The governance gap is now about controlling data access and prompt-time exposure, not blocking AI outright.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “How financial services firms secure GenAI with Proofpoint Data Security”.
Key questions
Q: What breaks when Copilot can reach data through over-broad permissions?
A: When Copilot inherits excessive access, it turns latent permission sprawl into immediate data exposure.
Q: Why do sanctioned AI tools create risk even when employees use approved accounts?
A: Approved accounts do not solve the problem if the connected data sources are too open or the tool can route content into supplier environments.
Q: What are the signs that shadow AI is creating governance and compliance gaps?
A: Common signs include limited visibility into who is using AI tools, no reliable audit trail for prompts and outputs, unclear data residency, and inconsistent handling of sensitive information.
Practitioner guidance
- Map AI-assisted data exposure paths Trace where Copilot, public LLMs, and embedded AI tools can access files, chats, and repositories, then identify which permissions make those surfaces searchable or retrievable.
- Inventory AI-connected non-human identities Catalogue every third-party app, connector, and AI-enabled integration in Microsoft 365 and other collaboration platforms, with owner, scope, and offboarding responsibility.
- Enforce prompt-time data loss controls Use DLP and content redaction on prompts, outputs, and copied content so sensitive material is blocked or masked before it reaches external models or supplier environments.
Bottom line: GenAI is increasing productivity in financial services, but it is also widening the gap between how data is used and how data access is governed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:32 pm
Prompt-time exposure is becoming the decisive governance boundary. Traditional access reviews were built around documents, folders, and sessions, but AI assistants collapse those layers into a single query surface. When a user can surface content through a prompt, the control that matters is whether the data can appear there at all. Practitioners need to treat prompt-time exposure as a governance state, not a side effect of productivity tooling.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations block GenAI or control the data it can see?
A: Controlling data is the stronger approach. Blanket blocking often fails when employees still need AI for daily work, while data-centric controls reduce exposure without stopping approved use cases. The practical test is whether the organisation can explain what data each AI workflow can reach and why.
👉 Read our full editorial: Shadow AI and Copilot data exposure are outpacing governance