In my previous interview, I spoke about the trend of AI itself becoming a target for hackers, and about new cyberattack vectors. Today, as I promised in that video, I want to talk about how AI, as a channel for leaking information, is affecting enterprises and organizations — and information security in particular.
The new name for this threat is Insider Threats — or, put more plainly, insider threats masked by AI. Employees using AI tools to covertly extract internal company data has been identified as one of the biggest corporate risks of 2026.
The rise in such data exfiltration cases has already prompted major PAM and security tooling companies to move actively towards developing new protective capabilities and countering these emerging threats.
When we talk about AI security, we usually focus on the AI model itself. In my view, however, one of the main problems for enterprises in the near term will be not AI itself, but how people use it. Because today, a very simple action an employee takes to speed up their daily work can turn into an information security incident.
For example: uploading a contract to ChatGPT to have it summarized; giving AI proprietary company code and asking it to find a bug; pasting internal correspondence or a report into it to draft a reply; having it analyse customer data; or even sending AI a screenshot and asking for help.
The user does not think they are stealing data. They simply want to get their work done faster. But from an information security standpoint, that data may already have left the information environment the organization controls. And I believe this will require us to revisit the classic concept of the insider threat.
In the past, when we thought of an insider threat, we pictured an employee copying data to a USB drive, sending it to a personal email account or deliberately taking it out of the organization. Now the same process can happen through a single prompt — and the user may do it without even realizing. In some cases, AI may also become a more convenient means of taking data out of the organization. In a certain sense, I would describe this as “the insider threat masked by AI”.
What is interesting is that, as I mentioned earlier, PAM and other security solutions have already begun to build their new strategies around this security problem.
The security market is already seeing distinct approaches emerge, such as AI Data Loss Prevention, Data Security Posture Management for AI, AI usage monitoring, Shadow AI detection, Insider Risk and Secure AI Gateway. Microsoft's current Purview capabilities, for example, can already detect users' access to AI websites and whether prompts sent to AI contain sensitive data, and in certain cases block sensitive data from being sent to an AI system.
This, in my view, shows quite clearly where the market is heading. My forecast is that organizations will soon have to host numerous companies offering such solutions and review their proposals. We will also see more new, AI-adapted versions of DLP, PAM, Insider Risk, CASB and other classic security products.
So if marketers soon start knocking on your door asking questions such as “What are your employees sending to ChatGPT?”, “Which AI tools are being used inside the company?” and “How do you block sensitive data from being passed to AI?”, do not be surprised. A new security market is already taking shape.
But there is another interesting side to this. States are no longer simply regulating AI in general terms; they are beginning to regulate the specific behaviours that arise when AI is used. In the European Union, for instance, the transparency requirements under Article 50 of the AI Act apply from 2 August 2026. One of the notable requirements concerns deepfake content: a person who encounters deepfake images, video or audio created or manipulated with AI must be made aware that it has been artificially generated or altered.
In other words, legislation no longer simply says “AI must be safe”. It now asks, specifically: “What have you done with AI, and how are you presenting the result to people?” Even more specific examples of this are emerging.
In the US state of Minnesota, a dedicated law on “nudification” technology took effect on 1 August 2026. It concerns services that use AI and other technologies to turn a real person's photo or video into a realistic-looking nude image.
The new law prohibits certain nudification services from offering this capability to users, as well as the advertising and promotion of such services. Violations carry civil penalties of up to $500,000 for each instance of unlawful access, download or use. This is a very interesting trend, because the subject of regulation is no longer just the AI model. The object of regulation is increasingly how people use AI and what consequences that use produces.
We will see the same trend in information security. In my view, at the next stage, one of the key questions facing enterprises will be not “How do we make AI secure?” but “How do we govern our people's secure use of AI?”
Because in the future, one of the things information security protects will be precisely the interaction between the user and artificial intelligence.
Sources & links
