Enterprise AI Security and PrivacyEnterprise AI Security and PrivacyCoverage from National Cyber Security Centre, Techtimes, and others
00/00/0000
DailyWeekly
Enterprise AI security and privacy focuses on the risks that arise when employees and business units use AI tools, APIs, and autonomous agents beyond established oversight.
Shadow AI can move customer information, source code, contracts, and internal communications into personal or unvetted services, while agents introduce additional concerns around credentials, permissions, inter-agent communication, logging, and lateral access. Organizations are responding with approved-tool policies, visibility audits, administered accounts, access controls, human review, and clearer accountability for AI-assisted work. The subject also intersects with privacy obligations and emerging frameworks such as the EU AI Act and NIST’s work on AI-agent standards.
It adds concrete findings about limited visibility into AI use and agent communications, complementing the broader guidance with evidence of governance gaps.
It explains the privacy-specific challenge of governing agents’ ongoing delegated actions through scoped access, traceability, and workable consent.
Future of Privacy Forum
Key Issues
01
Unapproved AI use moves data beyond organizational control
Employees use unsanctioned AI tools for work, potentially sending customer, personal, and proprietary information to external services beyond organizational visibility and control. The corpus describes both widespread use and concrete exposure pathways, making this an active data-governance risk.
Drawn from 5 articles
02
Visibility and access-control gaps make AI use difficult to govern
Organizations face incomplete visibility into AI activity and gaps in controls over data movement, access, and identities. This complicates inventory, auditing, and limiting exposure; the reporting identifies safeguards and control shortfalls but does not establish how widely effective controls are implemented.
Drawn from 4 articles
03
AI agents extend data-access and privilege risks
Connected agents can act across data, services, and delegated permissions, so weaknesses or misconfigurations may expose information beyond a user's immediate interaction. Reporting points to scoped, reviewable access and traceable identities and delegation as safeguards, without showing how broadly those protections are in place.
Drawn from 3 articles
Key Numbers
31% percent
breaches attributed to exploitation of software vulnerabilities as the initial breach vector
2026
“The report found that exploitation of software vulnerabilities had surpassed stolen credentials as the leading initial breach vector, accounting for 31% of breaches. Ransomware appeared in 48% of breaches, and generative AI was used during several stages of attacks.”
Forbes
48% percent
breaches involving ransomware
2026
“The report found that exploitation of software vulnerabilities had surpassed stolen credentials as the leading initial breach vector, accounting for 31% of breaches. Ransomware appeared in 48% of breaches, and generative AI was used during several stages of attacks.”
Forbes
71% percent
employees reporting use of employer-unapproved AI tools
“Research cited by the NCSC found that 71% of employees reported using AI tools that had not been approved by their employer.”
National Cyber Security Centre
Looking Back
448 Day Timeline
Articles published over time. Hover any bar for the period and its article count.
Jul '25
Oct '25
Dec '25
Mar '26
May '26
Jul '26
Oct '26
The Story So Far
No material change
The new articles reiterate existing concerns about shadow AI, data exposure, breach costs, and security controls. A reported customer-data breach adds an example but does not materially change the Topic.
Previously
Shadow AI—employees’ use of workplace AI tools without organizational approval—can send customer data, internal records, and intellectual property to services outside established security controls. Reports associate these practices with data exposure and higher breach costs, while highlighting gaps in access controls, monitoring, and usage policies. Organizations are being urged to make approved tools practical and visible, audit AI use, and control what data and privileges AI systems can access.
History
10/03/2026
The current version largely reinforces the existing account, with slightly more explicit attention to retention and deletion controls for data shared with external AI services.
The UK National Cyber Security Centre warned organisations on 7 September 2026 that unapproved AI services can expose sensitive data and weaken privacy governance.
9/7/2026 • Cybersecurity (Privacy-Relevant) • General
Verizon reporting and a PagerDuty survey highlight rising Shadow AI use at work, increasing the risk of sensitive data leakage into unsanctioned AI tools.
6/16/2026 • Cybersecurity Tech (Privacy-Relevant) • General
The FTC Safeguards Rule under GLBA can be triggered by employee uploads of customer nonpublic personal information into unsanctioned AI tools, creating access-control and breach-notification risk.
6/15/2026 • Regulation, Law & Enforcement • General
Community Bank disclosed a May 7 SEC filing after unauthorized employee use of an external AI tool exposed customer names, birth dates, and Social Security numbers.
5/16/2026 • Data Breaches & Exposure Events • General
Gartner and Gravitee findings report limited oversight for interconnected AI agents, while IBM research links shadow AI to higher breach costs and delayed detection in 2025-2026 incidents.
5/1/2026 • Cybersecurity (Privacy-Relevant) • General
Verizon's 2026 Data Breach Investigations Report found across 145 countries that software vulnerability exploitation led confirmed breaches, reinforcing controls for AI agents and sensitive data.
9/15/2026 • Cybersecurity (Privacy-Relevant) • General
The Future of Privacy Forum scheduled a California workshop for October 21 to examine identity, authorization, accountability, and data access in agentic AI deployment.
WalkMe and Reco data show high shadow AI adoption, while security leaders warn that unmanaged AI tools can leak information and create exploitable entry points for enterprises.
CrowdStrike, Microsoft, and Change Healthcare breach lessons drive a proposal to update HIPAA Security Rule safeguards focused on enforcement and visibility.
7/7/2026 • Cybersecurity (Privacy-Relevant) • General
Brave researchers and a described AWS enterprise workflow show indirect prompt injection can let an AI agent escalate privileges and exfiltrate sensitive HR data.
6/29/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Singapore enterprises face privacy-relevant breach escalation as shadow AI leaks, human error, third-party compromise, and ransomware spread through vendor ecosystems.
6/17/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Teramind released The Shadow AI Behavior Report in 2025, finding unmanaged personal accounts and limited visibility into AI data movement across organizations.
6/17/2026 • Cybersecurity Tech (Privacy-Relevant) • General
CrowdStrike reported prompt injection affected more than 90 organizations in 2025, enabling credential theft and data exfiltration from LLM agents and copilots.
6/29/2026 • Cybersecurity (Privacy-Relevant) • General
Enterprise users in enterprise cloud platforms such as ServiceNow face privacy risk as AI agents enable data exfiltration during ongoing workflow automation.
2/23/2026 • Data Breaches & Exposure Events • General
AppOmni researchers disclosed data exfiltration risk in ServiceNow AI agents in late 2023 across European and global enterprise platforms, highlighting privacy risks in automated workflows.
2/23/2026 • Data Breaches & Exposure Events • General
Cloudflare released Cloudflare OS in 2026 as an open-source enterprise AI workspace using Gatekeeper Workers and observation logs to control agent access to organizational data.
Meta acquisition of Moltbook highlights privacy governance gaps as a reported breach exposed authentication keys and identities for autonomous AI agents.
Adaptive Security describes an AI governance approach to reduce shadow AI by combining approved tool pathways, data classification limits, and browser-native monitoring.
Employees increasingly use generative AI without IT security approval, creating shadow AI that can expose sensitive data through unmonitored tools and integrations.
Spain's Data Protection Agency reported on September 15 an alleged AI-agent personal data breach in Spain as healthcare organizations faced rising AI-enabled security threats.
9/28/2026 • Cybersecurity (Privacy-Relevant) • General
Organizations face greater privacy risk in 2026 as AI agents accelerate cyberattacks and access sensitive data across connected technology environments.
8/30/2026 • Cybersecurity (Privacy-Relevant) • General
IBM and Ponemon reported in 2025 that AI model breaches affected 13% of studied organizations globally and most lacked AI access controls, increasing PII exposure.
7/30/2025 • Data Breaches & Exposure Events • General
Vercel disclosed a third-party Context.ai mediated intrusion on employee Workspace credentials, compromising some customer accounts and prompting account-response steps.
4/21/2026 • Cybersecurity (Privacy-Relevant) • General
Cloudflare said on August 4 that AI-agent wallets and persistent identities could support online transactions, while privacy experts and financial firms questioned human accountability and data control.
UNC6395 used an OAuth token tied to Salesloft Drift integration to access Salesforce environments, illustrating how AI-fueled identity sprawl can amplify breach risk in 2025.
7/10/2026 • Cybersecurity (Privacy-Relevant) • General
Security and compliance expectations for ongoing access governance are emphasized as cloud oversharing persists and AI tools increase the impact of exposed personal data.
7/8/2026 • Corporate Data Practices & Accountability • General
A report warns that enterprise agentic AI systems can leak PII and credentials via unpredictable agent-to-agent communication without strong data governance and observability.
Enterprise organizations in 2026 are facing privacy exposure from employee use of unapproved AI tools across sales, marketing, finance, and other workplace teams.
CB Financial Services, Inc. disclosed May 5, 2026 that an unauthorized employee-used AI application exposed sensitive customer information, raising privacy and incident-response concerns.
7/23/2026 • Data Breaches & Exposure Events • General
Verizon and WatchGuard findings describe widespread unauthorized AI tool use by employees in trucking and other workplaces, raising risk of sensitive data leakage into public AI models.
7/17/2026 • Cybersecurity (Privacy-Relevant) • General
IBM and Ponemon Institute report AI adoption is outpacing security governance, increasing breach risk and costs for organizations lacking AI policy controls.
7/2/2026 • Cybersecurity (Privacy-Relevant) • General
IBM 2025 breach findings and OT security experts highlight privacy-relevant risks from embedded AI in DCS and SCADA, especially shadow AI and missing AI access controls.
5/26/2026 • Cybersecurity (Privacy-Relevant) • General
Hugging Face reported an agentic AI-led cyberattack in which malicious agents performed thousands of actions, using OpenAI models, prompting calls for tighter workplace access controls.
7/22/2026 • Cybersecurity (Privacy-Relevant) • General
Verizon released the 2026 Data Breach Investigations Report in 2026 describing increasing Shadow AI and unauthorized gen AI data submissions on corporate devices.
5/28/2026 • Cybersecurity (Privacy-Relevant) • General
Actualyze AI launched on August 3 in Las Vegas to help enterprises control sensitive-data exposure, access, routing, and spending across generative AI systems.
AvePoint and Osterman Research reported in 2026 that enterprise AI agents were linked to widespread security incidents across surveyed organizations amid expanding AI-generated data.
Security leaders said employee use of AI tools increased exposure risk for source code and customer data, prompting expanded privacy controls like data classification and zero-trust access.
Verizon's 2025 Data Breach Investigations Report identified unauthorized generative AI use on corporate devices as a growing data-loss risk for companies.
5/28/2026 • Cybersecurity Tech (Privacy-Relevant) • General
Verizon reported in 2025 data loss prevention findings that 67% of corporate users use unauthorized generative AI tools, increasing IP and personal data exposure risk.
5/29/2026 • Privacy Technology & AI • General
National Law Review / Joseph J. Lazzarotti, Damon W. Silver41
Recently, Jackson Lewis privacy leaders Joe Lazzarotti and Damon Silver advised AI-adopting organizations to limit data exposure and strengthen incident readiness across connected business systems.
9/28/2026 • Corporate Data Practices & Accountability • General
Teramind released The Shadow AI Behavior Report based on 300 security executives and external research, finding governance gaps from speed-first AI adoption and unmanaged accounts.
6/17/2026 • Corporate Data Practices & Accountability • General
Five Eyes on June 22, 2026 warned that frontier AI will compress cyber attack timelines, advising faster patching and stronger identity and access controls.
6/26/2026 • Cybersecurity (Privacy-Relevant) • General
AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
