Key Insights
Cyberhaven Labs research across 222 companies found that nearly 40% of AI interactions involve sensitive data. For the average employee, that works out to proprietary information going into an AI tool once every three days. A third of employees reach these tools through personal accounts, including 58% of Claude users.
The breach data is catching up. An analysis of IBM's 2026 Cost of a Data Breach Report found that security incidents involving shadow AI rose to 43%, from 20% a year earlier, and that breaches involving shadow AI averaged $5.39 million. Sixty-eight percent of breached organizations had no AI governance policy or were still writing one.
Most of the advice so far has been about blocking, and our CISO's six-step strategy covers why that pushes data somewhere you can't see. This post looks at the size of the problem, and at what an older version of it can teach.
What 40% Looks Like at a 10,000-Person Company
Do the math. One sensitive interaction per employee every three days is roughly 3,300 sensitive conversations with an AI every working day. That's about one every nine seconds from nine to five, and more than 800,000 a year.
None of it crosses an email gateway or shows up in a file-share audit. It happens in a chat window, often in a browser tab security never sees.
Who Is Sharing Sensitive Data With AI
The people doing this are your recruiter summarizing forty résumés before lunch, your account manager prepping a renewal call, your engineer debugging production at 2 a.m. They took the "use AI to work faster" message seriously.
That makes this a productivity story with a security consequence. Programs that treat it as an insider-threat problem tend to lose the cooperation of the people they most need.
Why the Prompt Is the New Email Attachment
In 2005, the risky thing an employee did with company data was attach it to an email. Security spent the next fifteen years building controls around that one action.
The prompt has replaced the attachment, with a few twists. The data isn't a file you can fingerprint. It gets paraphrased, summarized, and pasted in fragments. It may be retained or used for training under a free-tier account. And it goes to vendors your procurement team never evaluated.
The newest twist is that the employee doesn't always do the sharing. Assistants connected to mail, files, and CRM pull data on request. In August, Varonis showed that a single click on a crafted link could make Microsoft Copilot Personal run a prompt that leaked data from connected accounts. Microsoft patched it, and no exploitation in the wild was reported. The point stands: the attachment has started sending itself.
What the Attachment Era Teaches About AI Data Protection
Email security got useful in a particular order, and the same order applies now.
Visibility came first. Attachment controls only worked once teams could see what was leaving and to whom. For AI, that means knowing which tools are in use, through which accounts, with which kinds of data. That inventory is the starting point for shadow AI governance.
Volume forced proportion. No team reviewed every outbound attachment by hand. At one sensitive interaction every nine seconds, the same is true of prompts. Most events should be recorded, a small share deserve intervention, and hard stops belong to the few cases where the answer is never in doubt.
The destination mattered as much as the content. The same spreadsheet meant something different sent to a colleague than to a personal Gmail address. The same forecast means something different in the approved enterprise workspace than in a free-tier personal account.
Three Questions to Ask About Sensitive Data in AI
Three questions are a good place to start. First, do you know your own number: how many sensitive interactions with AI happen in your company on a working day? Second, what share goes through personal or free-tier accounts, and where does your visibility of those accounts end? Third, which connected AI assistants can read company data without an employee pasting anything at all?
None of the three needs a new product to start. They need someone to ask and an honest answer, reviewed each quarter with the business leaders whose teams use AI most.
We track how sensitive data moves through AI tools and what security teams are learning about it. Our AI security resource hub collects our latest research, guides, and analysis in one place.
Get AI Security Resources