AI Governance / Security / Privacy
BlackFog-commissioned survey finds 47% of firms report sensitive data exposed through AI tools
In the vendor-commissioned survey of 400 US and UK security leaders, 77% of those reporting an incident said an approved AI tool was involved, and 56% said autonomous agents fall outside existing controls.
Cybersecurity vendor BlackFog has published research, carried out by Sapio Research in September 2026, surveying 400 IT security decision-makers at US and UK companies with more than 500 employees. 47% said their organisation had experienced an incident in which sensitive data was exposed through an AI tool, and 77% of those said a company-approved tool was involved.
The survey points to visibility gaps: 62% could identify users or departments sending data to AI tools, but only 48% could provide any record of the types of data that left through them. Although 98% reported an AI usage policy, 35% relied on written prompt rules without technical enforcement. 56% said autonomous AI agents acting for employees fall outside existing controls, rising to 70% in technology and telecoms.
According to CDO Magazine, the survey does not identify the organisations, tools or timing of incidents, nor whether exposed data reached third parties.
Editor’s note: This article relies on a vendor-commissioned survey announced by BlackFog and on trade press coverage of it; the findings have not been independently verified.
Why it matters
The findings, if representative, suggest that approving a list of AI tools does not by itself control what data enters them. Governance teams should check whether data classification labels are enforced at the point data is sent to sanctioned AI tools, and whether they can produce records of which data types have left through those tools. Agents operating with employee permissions need named owners, scoped access and activity logging, as they appear to be the least covered area.
Status: Published. Vendor-commissioned survey of 400 US and UK security leaders
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Who should care
- CDO
- CISO
- AI governance lead
- DPO