Topic starter
22/06/2026 10:15 am
TL;DR: Workers are uploading personal and payment data into ChatGPT, Copilot, Gemini and similar tools, with roughly 40% of file uploads containing sensitive data and often bypassing classic DLP because the action happens through personal accounts, according to Netwrix. The governance gap is now at the endpoint and prompt boundary, where prevention matters more than after-the-fact discovery.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Verhindern Sie, dass Ihre sensiblen Daten in der KI-Cloud landen â bevor es zu spät ist”.
Key questions
Q: What breaks when employees use personal and corporate AI accounts interchangeably?
A: Interchangeable account use breaks attribution, policy enforcement, and data handling assumptions.
Q: When should organisations prioritise endpoint DLP over gateway inspection?
A: Prioritise endpoint DLP when employees regularly use browser-based AI tools, desktop assistants, or local AI applications.
Practitioner guidance
- Block sensitive uploads at the device boundary Use endpoint policy to inspect files, clipboard content, and drag-and-drop activity before users can move regulated data into AI tools or web apps.
- Classify the AI channels employees actually use Map sanctioned and unsanctioned paths for ChatGPT, Copilot, Gemini, browser sessions, and personal accounts so policy covers the real workflow.
- Enforce uniform rules across endpoints Apply consistent controls on Windows, Linux, and macOS so the same sensitive-data policy follows the user regardless of device type.
Bottom line: Sensitive information is reaching consumer and workplace AI tools through ordinary employee workflows, which creates a prevention problem at the endpoint boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 11:04 am
AI cloud data loss prevention now sits at the endpoint, not only in the DLP stack. The article describes a user behaviour problem that classic perimeter-style DLP cannot reliably contain once data reaches consumer AI services. The practical shift is that policy has to evaluate the action before the upload or paste occurs, because after that point the organisation has already lost timing advantage.
A question worth separating out:
Q: How should security teams stop employees pasting sensitive data into AI prompts?
A: Security teams should control the browser or endpoint where the paste occurs, not rely only on network or file DLP. Classify text before it is submitted, block sensitive categories in consumer AI destinations, and log the event to an enterprise identity. The goal is to stop disclosure at the moment of composition.
👉 Read our full editorial: Preventing sensitive data from reaching AI clouds with endpoint controls