A contract to summarise, an email to rewrite, code to debug, a customer file to analyse\u2026 In just a few seconds, generative AI tools can save employees valuable time.<\/p>\n\n\n\n
But behind these increasingly common uses lies an essential question: what data is actually being shared with these tools?<\/strong><\/p>\n\n\n\n The rapid adoption of artificial intelligence is creating new information flows that companies now need to integrate into their cybersecurity strategy. The objective is not necessarily to ban AI, but to enable its use without losing control over company data<\/strong>.<\/p>\n\n\n\n Using generative AI may seem harmless. Yet, to obtain a relevant answer, users are often tempted to provide additional context.<\/p>\n\n\n\n That context may contain confidential information: customer data, financial information, contractual documents, HR data, source code, strategic information or technical credentials.<\/p>\n\n\n\n The risk therefore does not come solely from the tool itself, but also from what employees share with it<\/strong>.<\/p>\n\n\n\n Sending text, images or documents to a third-party generative AI service may involve transmitting this information to an infrastructure outside the company\u2019s direct control.<\/p>\n\n\n\n This issue is becoming increasingly important as AI use cases continue to spread across business functions.<\/p>\n\n\n\n Companies already have numerous measures in place to protect their information: access rights management, encryption, endpoint security, email controls and file transfer monitoring.<\/p>\n\n\n\n But generative AI is creating new use cases.<\/p>\n\n\n\n An employee can copy a few lines from a contract directly into a web interface, upload an entire document to an AI assistant or connect a tool to various internal sources of information.<\/p>\n\n\n\n The risk becomes even more significant with the development of agentic AI<\/strong>. These systems go beyond answering questions: they can access different applications, process information from multiple sources and perform certain actions on behalf of the user.<\/p>\n\n\n\n The more AI becomes integrated into information systems, the more strategic control over data flows<\/strong> becomes.<\/p>\n\n\n\n DLP, or Data Loss Prevention<\/strong>, refers to the technologies and policies used to identify sensitive information and prevent its unauthorised disclosure or transfer.<\/p>\n\n\n\n Traditionally, a DLP strategy can be used to monitor or control:<\/p>\n\n\n\n With the rise of generative AI, these systems now need to consider a new potential channel through which information can leave the organisation: AI tools themselves.<\/strong><\/p>\n\n\n\n The objective may, for example, be to detect when a user attempts to send certain categories of data to an unauthorised service and, depending on company policies, alert, block or control the action.<\/p>\n\n\n\n No. Technology alone cannot address every risk.<\/p>\n\n\n\n An effective strategy relies on several complementary layers of protection.<\/p>\n\n\n\n Identify the data that needs to be protected.<\/strong> Not all information has the same level of sensitivity. Companies need to know which data is confidential, personal, strategic or subject to specific requirements.<\/p>\n\n\n\n Define authorised tools.<\/strong> An AI solution integrated and managed by the company does not necessarily operate under the same conditions as a public service freely used by an employee.<\/p>\n\n\n\n Implement technical controls.<\/strong> DLP and other cybersecurity tools can translate part of the company\u2019s security policy into practical controls.<\/p>\n\n\n\n Raise employee awareness.<\/strong> Users need to understand why certain information should not be copied into a prompt and which tools should be used depending on the context. Awareness is a key component of any cybersecurity strategy, as we also discuss in our article \u201cAwareness: A Strategic Pillar of Cybersecurity.\u201d<\/strong><\/p>\n\n\n\n Monitor changing use cases.<\/strong> AI is evolving rapidly. Rules defined today will need to adapt as new assistants and agents become integrated into working environments.<\/p>\n\n\n\n Protecting data in the age of AI therefore requires a combination of governance, technology and awareness<\/strong>.<\/p>\n\n\n\n Defining an AI charter or usage policy is an essential first step. It can specify which tools are authorised, which uses are accepted and what information may or may not be shared.<\/p>\n\n\n\n But those rules also need to be enforced.<\/p>\n\n\n\n This is precisely where cybersecurity and DLP complement governance: governance defines the framework, while security measures help enforce it.<\/strong><\/p>\n\n\n\n This approach avoids treating innovation and security as opposing objectives. Instead, it gives employees access to the benefits of AI within an environment where risks have been identified and managed.<\/p>\n\n\n\n To explore this topic further, read our article \u201cYou\u2019re Already Using AI. Have You Defined the Rules That Go With It?\u201d<\/a><\/strong><\/p>\n\n\n\n Securing AI use first requires understanding how data flows through your organisation and how employees are actually using these new tools.<\/p>\n\n\n\nWhen a Simple Prompt Becomes a Risk to Your Data<\/h2>\n\n\n\n
Why Is AI Changing the Way Companies Protect Their Data?<\/h2>\n\n\n\n
DLP: What Is Data Loss Prevention?<\/h2>\n\n\n\n
\n
Is DLP Enough to Secure AI Use?<\/h2>\n\n\n\n
From AI Governance to Data Protection<\/h2>\n\n\n\n
How Can L\u00f9kla Support You?<\/h2>\n\n\n\n