Quick Buzz Feed
AI tools create overlooked data-transfer channels, exposing organisations to shadow AI, insider threats, fraud, and credential attacks.
Many employees fail to perceive the act of inputting information into AI tools as a data transfer, equating it to sending data to an external recipient. This misperception is critical because once corporate data is fed into an external AI service, it effectively leaves the organization's secure and controlled environment. While platforms may offer settings to restrict data retention or prevent model training, there's no assurance that employees will configure these settings correctly. Even with all possible restrictions enabled, the underlying AI system might still legitimately access the data. Furthermore, AI services are increasingly acting as indirect data transfer pathways. For instance, an employee might upload confidential work documents from a company device and later access the same conversation or information through their personal AI account on a home device, effectively turning the AI platform into unauthorized external storage for corporate data. This exact scenario has been observed in practice, highlighting a significant and often overlooked vulnerability in corporate data security, where personal convenience through AI tools leads to unintended data exfiltration.
The emergence of AI tools does not eliminate traditional insider risks; rather, it often exacerbates them. Employees and contractors continue to access an increasing number of systems, cloud platforms, and collaboration tools, expanding the potential attack surface. A recent Verizon report indicates a third party was involved in 48% of data breaches, a substantial increase from 30% the previous year. In Malaysia, the financial repercussions are significant, with the PIKOM report "Beyond Compliance: The State of Cyber Resilience Malaysia 2026" noting an average data breach cost of RM3.2 million, and some organizations reporting losses exceeding RM5 million from a single incident. This report also highlights that 35.9% of surveyed Malaysian organizations experienced at least one cybersecurity incident between January 2024 and December 2025. The proliferation of data channels in daily operations directly correlates with a higher likelihood of confidential information misuse or abuse of legitimate privileges. Additionally, compromised credentials pose a severe threat, allowing criminals to operate under a legitimate employee's identity, making their actions appear trustworthy. The rise of AI-generated phishing, voice imitation, and executive impersonation further enhances the convincing nature of such attacks. According to PIKOM data, AI-generated phishing and deepfake impersonation are now the most prevalent attack types reported by Malaysian organizations (32.6%), surpassing malware and ransomware-as-a-service (30.2%) and credential theft (25.6%). Corporate fraud also remains a constant concern, encompassing activities like data theft, document forgery, conflicts of interest, misuse of company assets, or leveraging internal information for personal financial gain.
To effectively mitigate these evolving insider risks, organizations must first establish comprehensive visibility over their sensitive information. This involves understanding what data is held, its storage locations, classification, and who has access. Regular audits of file repositories and cloud storage are crucial, along with the removal of excessive permissions and diligent monitoring of any changes to access rights. Data Classification and Protection (DCAP) tools can be instrumental in providing this essential visibility. Secondly, companies need to implement robust controls over data movement across all potential transfer channels, which include email, cloud services, messengers, collaboration platforms, removable devices, printers, remote-access tools, and newly emerging AI-enabled applications. The focus of these controls should be on the data itself, ensuring it is protected irrespective of the application or channel, rather than merely restricting a limited set of applications. Data Loss Prevention (DLP) systems are vital for detecting and preventing risky data transfers across this broad spectrum of channels. Furthermore, organizations should proactively analyze behavioral and data-activity anomalies, such as unusual data uploads, unexpected changes in file activity, and deviations from established normal working patterns, as these can indicate potential insider threats. Lastly, ongoing and specific employee training is paramount. Generic advice on "responsible AI use" is insufficient; organizations need to develop clear, enforceable policies outlining approved AI tools, data that is prohibited from being used with external AI, and mandatory reporting procedures for suspected incidents. Staff must also receive specialized training to identify sophisticated phishing, impersonation, and other social engineering tactics that leverage AI to target sensitive data, credentials, or financial transactions.