BlackFog research finds widespread data exposure through AI tools

Around half (47%) of security leaders report sensitive data exposure through an AI tool at their organisation, with 77% of these incidents involving a company-approved AI tool, according to BlackFog’s research. The findings suggest many organisations lack visibility into what data is being shared with AI tools, even when tools are sanctioned for enterprise use.

While 62% could identify which users or departments are sending data to AI tools, fewer than half (48%) could provide any record of the types of data leaving the organisation via AI. Darren Williams, founder and CEO of BlackFog, said this shows that security teams cannot merely decide which AI tools to permit; they must also control what information is shared with them.

The report highlights a governance gap around AI agents operating inside organisations. Although 98% of respondents have an AI usage policy, enforcement is uneven: 56% are supported by comprehensive technical controls, while about a third (35%) have a written policy restricting what information employees must not enter into prompts but lack technical enforcement. Notably, 39% said AI adoption is outpacing governance, and among those, just 27% have comprehensive AI controls.

Delegated AI agents outside organisational controls were reported by 56% of respondents, with technology and telecoms sectors most affected (70%). Additionally, 54% said they could block or restrict unsanctioned tools, but roughly a third (32%) can detect shadow AI use and still cannot consistently stop it. All figures are from BlackFog’s cited research published on 4 November.