Only 29% of Teams Can Report Sensitive AI Data Transfers

Only 29% of security teams can routinely report how often employees sent sensitive data to generative AI tools, according to a Cloud Security Alliance survey of 433 IT and security professionals.

The CSA’s 2026 report, DLP in the AI Era, commissioned by Jazz, asked 433 respondents in June and July if teams could produce a 30-day count of sensitive-data transfers to GenAI. Only 29% could, although 48% ranked GenAI among their top three exfiltration risks. HR and security teams must link data, accounts and the employee's work purpose when assessing incidents.

What can employers actually prove?

Just over half of the 433 respondents rated their visibility into GenAI at 4 or 5 out of 5, yet only 29% could routinely produce the requested 30-day count.

The average organization in Jazz's customer telemetry used 169.5 distinct AI tools. Only 9.8 were approved, leaving 94.2% outside the approved list.

Most governance starts by approving a few AI services under enterprise agreements and discouraging or blocking the rest. The source's author attributes part of the gap to procurement: approval can take weeks, so employees use whichever tool solves the immediate problem.

The source's author leads engineering at a company that builds data-loss-prevention tools. Their work examines where systems record data movement and why risk emerges. They attribute the visibility gap to how GenAI controls were designed.

The author wrote: “Your incident team, or an auditor, will ask about a specific event in which data left, and a list of tools contains no events.” Reconstructing that transfer requires:

• The sensitive data involved and where it came from.
• Which AI tool received it.
• Which account carried it, corporate or personal.
• What work purpose prompted the transfer.

Account identity determines evidence quality. A corporate account includes enterprise retention settings and contract terms. A free personal account has neither. Using an approved service through a personal login can leave about as much evidence as using an unapproved service.

Purpose determines whether anything went wrong, but it sits outside the payload. A finance analyst may paste a revenue model into a chatbot to fix a broken formula. A similar paste by someone who handed in a notice on Friday warrants a different employment conversation. The surrounding context never appears in the data transfer.

Why is strict blocking limited?

Only 22% of the 433 respondents strictly block sensitive data on the GenAI channel. Removable media, ranked as the lowest exfiltration risk, has the highest strict-block rate at 31%. The pattern shows enforcement clustering around channels with older tooling.

In the 433-person survey, no control approach dominated:

• Network-level blocking of AI domains, browser-based content inspection and acceptable-use policy alone each drew 21% to 23% of responses.
• Enterprise AI platforms with built-in DLP drew 10%.

Each control inspects one place. A domain block permits or stops a connection and records the site. A browser extension sees what users type in that browser but misses anything sent from a desktop app, a coding assistant inside a code editor or a command-line tool. An enterprise AI platform's built-in DLP sees what enters that platform.

These gaps force blunt enforcement. If a control cannot distinguish a corporate account from a personal one, or routine work from risky behavior, it must block both or neither. Asked why they had not moved more aggressively to active blocking, 46% of the 433 respondents cited fear of disrupting business workflows and 39% cited insufficient confidence in DLP accuracy.

How far do the findings generalize?

The survey relied on self-reports and did not test visibility ratings against actual coverage. Respondents skewed toward the Americas, at 80%, and organizations with fewer than 5,000 employees, at 67%. Those limits matter because the results may not transfer evenly to large global enterprises.

The telemetry also came only from organizations that chose to deploy this kind of visibility. That selection may skew the results toward employers already concerned about AI sprawl.

Software changes the evidence model. As approved SaaS products add AI assistants, the receiving tool can mean both the application the employee opened and the AI model provider behind it. AI agents can pull files and send them, shifting part of the who and why to software behavior.

A recent Unite.AI analysis cited in the source warns that prompt injection can steer an agent through content it reads. An agent's own account therefore cannot substitute for evidence of purpose.

What should employers test this month?\n

Use the last 30 days to identify the most sensitive piece of data believed to have reached an AI tool. Then check whether the team can produce four records without building them by hand:

• What the data was and where it came from.
• Which tool received it, including tools outside the approved list.
• Whether it used a corporate account or a personal one.
• What the person was working on when they sent it.

The source's author set a clear benchmark: “If the first two come back quickly and the last two require interviewing the employee, your governance covers your tool list and very little of your data.”

As approved services add assistants and AI agents, employers will need event-level records linking data, accounts, people and purpose, rather than inventories that merely name the software in use.