Netskope has published new research into generative AI (genAI) and risk management. Using global data sets, the researchers found that 96% of businesses are now using genAI — a number that has tripled over the past 12 months.
On average, enterprises now use nearly 10 genAI apps, up from three last year, with the top 1% adopters now using an average of 80 apps, up significantly from 14.
With the increased use, enterprises have experienced a surge in proprietary source code sharing within genAI apps, accounting for 46% of all documented data policy violations. These shifting dynamics complicate how enterprises control risk, prompting the need for a more robust data loss prevention (DLP) effort.
There are positive signs of proactive risk management in the nuance of security and data loss controls organizations are applying: for example, 65% of enterprises now implement real-time user coaching to help guide user interactions with genAI apps. According to the research, effective user coaching has played a crucial role in mitigating data risks, prompting 57% of users to alter their actions after receiving coaching alerts.
Three-quarters of businesses surveyed now completely block at least one genAI app, which reflects the desire by enterprise technology leaders to limit the risk of sensitive data exfiltration. However, with fewer than half of organizations applying data-centric controls to prevent sensitive information from being shared in input inquiries, most are behind in adopting the advanced DLP solutions needed to safely enable genAI.
Securing genAI needs further investment and greater attention as its use permeates through enterprises with no signs that it will slow down soon. Enterprises must recognize that genAI outputs can inadvertently expose sensitive information, propagate misinformation or even introduce malicious content. It demands a robust risk management approach to safeguard data, reputation, and business continuity.
James Robinson, Chief Information Security Officer, Netskope
Key takeaways for enterprises
Netskope recommends that enterprises review, adapt and tailor their risk frameworks specifically to AI or genAI using efforts like the NIST AI Risk Management Framework. Specific tactical steps to address risk from genAI include:
Know your current state
Begin by assessing your existing uses of AI and machine learning, data pipelines, and genAI applications. Identify vulnerabilities and gaps in security controls.
Implement core controls
Establish fundamental security measures, such as access controls, authentication mechanisms, and encryption.
Plan for advanced controls
Beyond the basics, develop a roadmap for advanced security controls. Consider threat modeling, anomaly detection, continuous monitoring, and behavioral detection to identify suspicious data movements across cloud environments to genAI apps that deviate from normal user patterns.
Measure, start, revise, iterate
Regularly evaluate the effectiveness of your security measures. Adapt and refine them based on real-world experiences and emerging threats.
