Only 29% of Security Teams Can Routinely Report the Sensitive Data Employees Send to AI Tools

What happened

A survey conducted by the Cloud Security Alliance in June and July 2026 asked 433 IT and security professionals if their teams could routinely generate reports on how often sensitive data was sent to generative AI tools in the previous month. Only 29% of respondents said they could provide such reports regularly. Despite this, nearly half of those surveyed ranked generative AI as one of their top three data-exfiltration risks. The survey also found that most organizations use a large number of unapproved AI tools, making it harder to monitor and control data movement.

Key details

• 29% of security teams can routinely report sensitive data sent to generative AI tools.
• 48% of respondents ranked generative AI as a top three data-exfiltration risk.
• The average organization uses 169.5 distinct AI tools, with only 9.8 approved.
• 94.2% of AI tools in use are unapproved by organizations.
• Only 22% of teams strictly block sensitive data from being sent to generative AI tools.

Why it matters

Security and IT teams face significant gaps in their ability to track and control sensitive data shared with AI tools. Organizations are exposed to higher risks of data loss because most AI tools in use are not officially approved or monitored. This situation forces companies to choose between stricter controls that could disrupt business operations and accepting greater risk of unmonitored data exposure.