As generative AI slips seamlessly into the modern workplace, a new kind of insider risk is emerging. ENIS BYTYQI explores how everyday efficiency is blurring the boundaries of data security.
I came across a meme that made me laugh at first, but then I realised it was a bit too real. It showed a nonchalant-looking employee sitting at their desk, blissfully unaware, with the caption: “Me after uploading 100GB of confidential company data into ChatGPT so it can write an email for me.”
It’s funny because it reflects reality. In many workplaces, people use AI to write emails, summarise reports, solve problems or just make their jobs easier. But while this speeds things up, it quietly increases the risk that sensitive company data could leak out, bit by bit.
When help becomes a hazard
People usually think of insider risk as someone deliberately stealing data or leaking secrets. But now, it’s often unintentional. Employees might use AI tools to improve their work, not realising the risks. Most are just trying to be efficient, learn something new or keep up with deadlines, not put the company in danger.
According to research by Cyberhaven, more than 11 per cent of data employees paste into ChatGPT is confidential, ranging from customer details to source code. Fast Company reports that 14 per cent of users have admitted to entering trade secrets into AI tools, and these numbers likely underestimate the scale, since few people would willingly confess such slips.
The hidden cost of convenience
The attraction is very much understandable. Generative AI feels quite intimate and clever and, above all, it is seen as a reliable outlet that can help with almost anything. But these systems learn from what we give them.
When data goes into a public AI model, it might be stored, recorded or used to train future versions. Even if companies such as OpenAI say they filter out sensitive information, there isn’t enough transparency for businesses to know where their data actually goes. That uncertainty is a risk in itself.
Some organisations have learned this the hard way. In 2023, Samsung banned ChatGPT internally after staff reportedly uploaded confidential source code to the chatbot while trying to troubleshoot technical issues.
Similar incidents have since surfaced in finance, healthcare, law and other industries where data leaks would be very costly. Additionally, a Newsweek survey this year found that over half of employees use AI tools banned by their employer, often via personal accounts or browser tabs on work laptops.
Traditional shadow IT involved installing unauthorised software, but different from that, shadow AI hides before our eyes, embedded in browsers, apps and plugins. And in those cases, by the time a data-protection officer realises what’s happening, the data may already be gone.
So why does this happen?
In a nutshell, most people don’t set out to break policy. They just want to do their jobs better. Generative AI is marketed as an assistant; hence, when deadlines pile up, the temptation to “just paste it in” overrides caution.
And there is another aspect to this: the knowledge gap. many employees don’t understand that these public AI models are external services, not internal tools. Unlike internal systems, they work under different data laws and often have unclear rules on how data is used.
The reality is that no single tool or rule can stop shadow AI, at least for now. In its essence, it’s as much a cultural issue as it is a technical one.
Policies and firewalls might block access for a while, but if employees don’t understand why those limits exist, they’ll always find ways around them. CIOs are learning that the real fix comes from building digital trust, helping workers see that IT isn’t there to control them but to be a part of a support system.
That starts with education: showing teams that using unapproved AI tools is not a quick shortcut, but something that can lead to data leaks, rule-breaking and other ethical problems.
Building smarter safeguards
Yet awareness alone isn’t enough; workers also need options. When IT departments deliver secure, high-performing AI tools that genuinely improve day-to-day tasks, employees are much less likely to break the rules.
By pairing strong data governance with accessible AI roadmaps, CIOs can demonstrate that innovation and responsibility aren’t opposites but partners. This dual approach to educate, then empower, turns the idea of compliance into a shared commitment rather than a forced rulebook.
The link between AI and insider risk isn’t disappearing anytime soon; we can simply see it changing shape day by day. As generative AI becomes part of everyday work, organisations need to rethink how they approach security.
Now, when I see that meme, the one about the employee and the confidential data, I still smile, because that joke lands but the truth hits harder, and I can’t help but face the fact that the real issue isn’t that we use AI, but that we often do it on our own without guidance, oversight or a sense of how easily we can slip into risky territory.
