Only 29% of Security Teams Can Routinely Report the Sensitive Data Employees Send to AI Tools

This article is based on findings from the Cloud Security Alliance’s (CSA) 2026 survey report, DLP in the AI Era, which Jazz commissioned.

In June and July, CSA asked 433 IT and security professionals whether their team could produce a report showing how many times sensitive data was sent to GenAI tools in the past 30 days. Twenty-nine percent said they could produce it routinely.

That figure would matter less if respondents considered GenAI a minor channel. They ranked it as their top data-exfiltration risk, with 48% placing it in their top three.

I lead engineering at a company that builds data loss prevention, and most of my work is about where, inside a system, the evidence of data movement and why its risk gets created. From that angle, the gap between what teams believe they can see and what they can show follows directly from how GenAI controls were designed.

Confidence in GenAI Visibility Runs Well Ahead of What Teams Can Show

Just over half of respondents rated their visibility into GenAI at 4 or 5 out of 5. Yet only 29% could routinely back that rating with a report that simply counts how many times sensitive data went to an AI tool.

Source: Cloud Security Alliance, DLP in the AI Era (2026), n=433. Recreated from the report’s charts on pp. 22 and 23.

Enforcement follows the same pattern. Only 22% of respondents strictly block sensitive data on the GenAI channel. Removable media, which respondents ranked as their lowest exfiltration risk, has the highest strict-block rate, at 31%. Strict blocking clusters on the channels with the oldest tooling.

Source: Cloud Security Alliance, DLP in the AI Era (2026), n=433. Recreated from the report’s charts on pp. 23 and 26; bars scaled to 100% where rounding put a row at 99% or 101%.

Jazz also published telemetry from its customer environments alongside the survey. The average organization in that data had 169.5 distinct AI tools in use, of which 9.8 were approved, leaving 94.2% outside the approved list.

Why the Gap Exists: A Tool List Records No Events

The standard response to GenAI risk is to approve a handful of AI services under enterprise agreements and discourage or block the rest. The 94.2% figure shows how far that list falls behind in practice. An engineer with a deadline uses whichever tool solves today’s problem, because procurement for the approved one takes weeks.

A complete list still wouldn’t produce the report CSA asked about. Your incident team, or an auditor, will ask about a specific event in which data left, and a list of tools contains no events.

To show what happened in that event, you need four facts: what sensitive data was involved, which tool received it, which account it went through, and why the person sent it.

The account is where tool-level governance breaks first. The same website serves both your company’s enterprise account, with its retention settings and contract terms, and an employee’s free personal account, which has neither. An approved tool used through a personal login gives you about as much evidence as an unapproved one.

Purpose is harder, and it decides whether anything went wrong. A finance analyst pasting a revenue model into a chatbot to fix a broken formula is doing her job. The same paste from someone who handed in their notice on Friday deserves a very different conversation. What separates them is the context around the person, which never shows up in the payload.

The Controls in Use Each See One Place

The survey found no dominant approach to controlling sensitive data sent to AI tools. Network-level blocking of AI domains, browser-based content inspection and acceptable-use policy alone each drew between 21% and 23% and enterprise AI platforms with built-in DLP drew 10%.

Each of those controls was designed around a single inspection point. A domain block allows or stops a connection and records which site it went to. A browser extension sees what’s typed into that browser and misses anything sent from a desktop app, a coding assistant inside a code editor or a command-line tool. An enterprise AI platform’s built-in DLP sees what enters that platform. Every one of these picks one place to look and hopes that’s where the data goes.

The single inspection point also explains the enforcement numbers. If a control can’t tell a corporate account from a personal one, or a routine paste from a risky one, it has to block both or neither. Strict blocking then stops legitimate work along with the risky kind. Asked for the main reason they haven’t moved more aggressively to active blocking, 46% of respondents cited fear of disrupting business workflows and 39% cited insufficient confidence in DLP accuracy.

Caveats Worth Keeping in Mind

The survey numbers are self-reported, and the survey didn’t test the visibility ratings against actual coverage. Respondents skew toward the Americas (80%) and toward organizations with fewer than 5,000 employees (67%), so the results may not carry over evenly to large global enterprises. The telemetry comes from organizations that chose to deploy this kind of visibility, which may skew towards those already concerned about AI sprawl.

Approved Tools and Agents Will Make the List Weaker Still

As approved SaaS products add AI assistants, the question of which tool received the data often has two answers: the application the employee opened and the AI model provider behind it. AI agents complicate it further. When an agent pulls a file and sends it somewhere for an employee, the who and the why now belong partly to software. As a recent Unite.AI piece on prompt injection in production agents argues, an agent can be steered by content it reads, so its own account of what it did can’t stand in for evidence of purpose.

A Test You Can Run This Month

Take the last 30 days and pick the most sensitive piece of data you believe reached an AI tool. Then check whether your team can produce the following without building it by hand:

• What the data was and where it came from
• Which tool received it, including tools outside your approved list
• Whether it went through a corporate account or a personal one
• What the person was working on when they sent it

If the first two come back quickly and the last two require interviewing the employee, your governance covers your tool list and very little of your data.