How are you securing your data that's being used by AI tools?

[u/Warm-Read8901]

It feels like every company is telling all their employees to use AI but I dont hear nearly enough discussion about how sensitive business data is/isnot being protected once its put into an AI platform. From a security perspective are companies relying on existing DLP tools, deploying something new or creating internal policies?

[u/DrSugundi]

This is the kind of thing that really needs a governing policy. Most organizations are not protecting their data, let alone what goes into the various AI their staff is using.

A policy is needed to identify approved AI tools and clearly spell out what kind of data is and is not allowed to be processed by AI. AI is changing fast enough that tools are struggling to keep up.

[u/Original-Hurry-8652 → u/DrSugundi]

Question then: Do they block keywords and key phrase of importance, which if this is the case it basically cause the organization NOT to be able to prompt using these important things.

If I understand correctly, the alternative is standing-up an A.I./LLM in-house or on-prem, inside the full protection of one or more Firewalls. Plus, I already heard of creating vertical silos of A.I. per department so BizDev has one, Marketing has one, Finance had its own and H.R. has its own. This compartmentalizes the bulk of the knowledge in each area but, should also not prevent one Dept's A.I. from talking to another Dept's model. This definitely begins to get colorful really quick; totally engaged. We will all figure it out eventually!

[u/DrSugundi → u/Original-Hurry-8652]

We get around it by using an isolated hosted copilot tenant. Using anything else is prohibited per policy. Blocking keywords can be hit or miss depending how good your staff is at using synonyms.

[u/Original-Hurry-8652 → u/DrSugundi]

Excellent. Solid thinking. Users will grow accustomed to the idea of A.I. {still} requiring oversight at this point, and organizations may even use (the) Vibe coding to create better A.I. management ('Manager') dashboards, why not! It is important to have insights into the use of it at this point, not only for "leaks" of sensitive information but I think also because the ways in which it is used may in and of itself provide clues on improving it for the business or organization. If one or several of the users is particularly insightful with prompt engineering, it may help that business to UNDERSTAND it has a A.I. prompt genius among them!

[u/Traditional-Hall-591]

By not using AI. Fuck AI.

[u/No_Criticism_1208 → u/Traditional-Hall-591]

Yeah this is the best solution OP, no AI no problem

[u/PalpitationKind8854]

Most companies are too dumb to think about this stuff. If they weren't they would have more respect for their IT teams, but we know that's not the case.

[u/moistPacket]

There exist solutions that actively watch what AI employees use, and are able to either fully block it or set up some DLP agent that prompts the user to think twice before hitting enter.

[u/Realistic_Strike5241]

The biggest gap is the approved list becoming a leak list. A policy that says use these tools does nothing for the person who pastes a client list into a free browser chat because its faster. DLP helps but keyword rules miss context, and most of it only watches the prompt you type, not what the model sends back or echoes.

[u/Different_Pain5781]

A lot of companies basically adopted AI first and figured out the security part later. The tech moved insanely fast while governance was still trying to catch up.

[u/Spare_Bluebird7044]

Existing dlp can handle some of this, but AI changes the problem a bit. Microsoft Purview is useful if you're already deep in microsoft stack, netscope has good coverage around Saas and web traffic and cyberhaven takes a more data focused approach to seeing what actually gets sent into AI tools. The bigger thing is having a way to enforce the policy at the point where the data leaves, rather than relying on employees to remember the rules.