Topic starter
27/06/2026 1:03 pm
TL;DR: AI assistants are now a common path for accidental secret exposure, and Entro Security says WebGuard scans prompts in the browser to block secrets and PII before they reach major LLMs. The governance gap is that current IAM and DLP assumptions do not see what users paste into AI tools in real time.
Editorial analysis by NHI Mgmt Group, based on content published by Entro Security: “Entro WebGuard: stop sensitive data from leaking into AI tools”.
Key questions
Q: How should security teams govern employee use of public AI tools in the browser?
A: They should treat browser AI use as an identity and data-control problem, not just an acceptable-use issue.
Q: What breaks when prompts are not scanned before they reach external AI tools?
A: Without prompt scanning, sensitive data can leave through a sanctioned workflow before any enterprise control sees it.
Q: How do teams know whether AI prompt controls are actually working?
A: Look for whether the control is operating at the moment of prompt entry and whether it can distinguish data classes, account type, and destination.
Practitioner guidance
- Define prompt-time enforcement as a control boundary Treat the browser prompt as the point where sensitive data can leave the organisation, and write policy to enforce there rather than only in storage or network controls.
- Classify data by response severity Separate production secrets, credentials, and PII into different response paths so the control can block high-risk disclosures and warn or audit lower-risk ones.
- Log user decisions on prompt warnings Record what was detected, which action fired, and whether the user proceeded anyway so security and audit teams can trace disclosure decisions after the fact.
Bottom line: Browser-based AI use creates a disclosure path that existing IAM and DLP models often do not see in real time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
27/06/2026 2:13 pm
Browser-side prompt inspection is a control point, not a convenience feature: the core issue is that users now disclose secrets inside a browser session before enterprise logging or DLP can intervene. That shifts the enforcement boundary from network and endpoint monitors to the prompt itself. Organisations that do not control the prompt moment are effectively relying on user restraint as a security control, which is not governance. The implication is that AI usage policy must be enforced where data is authored, not only where it is stored or transmitted.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between blocking and auditing sensitive AI prompts?
A: Blocking stops the prompt and removes the sensitive content from the request, while auditing allows the prompt to continue and records what was detected and who approved it. Blocking is for high-risk secrets; auditing is for observation, policy tuning, and lower-risk data where visibility comes first.
👉 Read our full editorial: Browser-side AI prompt scanning closes secret exposure gaps
This post was modified 4 days ago by NHI Mgmt Group