on average, most organizations will see a total of 66 genAI apps in their environments. The bulk of those among PAN customers were “writing assistants” (34% of the sample. The biggest in this category was Grammarly); “conversational agents” (just under 29%, apps such as Microsoft Copilot, ChatGPT and Google Gemini); “enterprise search” apps (just over 10% of the sample) and “developer platform” apps (just over 10%). These four alone make up 84% of the genAI apps seen;10% of genAI apps are called ‘high-risk’ because, according to customer telemetry, access to them was restricted or blocked by customers at some point or points during the study period;data loss prevention (DLP) incidents for genAI detected by PAN more than doubled this year compared to 2024.Writing assistants aren’t applications to be taken lightly, the report warns. “If an AI writing assistant is integrated into an organization’s systems without proper security controls, it could become a vector for cyberattacks. Hackers could exploit weaknesses in the genAI app to gain access to internal systems or sensitive data.””As genAI adoption grows, so do its risks,” it says. “Without visibility into genAI apps, and their broader AI ecosystems, businesses can risk exposing sensitive data, violating regulations, and losing control of intellectual property. Monitoring AI interactions is no longer optional. It’s critical for helping prevent shadow AI adoption, enforcing security policies, and enabling responsible AI use.”The report identifies these genAI security best practices for CISOs:
understand genAI usage and control in the enterprise and what is allowed. Implement conditional access management to limit access to genAI platforms, apps, and plugins based on users and/or groups, location, application risk, compliant devices, and legitimate business rationale;guard sensitive data from unauthorized access and leakage through real-time content inspection with centralized policy enforcement across the infrastructure and within data security workflows to help prevent unauthorized access and sensitive data leakage;defend against modern AI-based cyberthreats through a zero trust security framework to identify and block highly sophisticated, evasive, and stealthy malware and threats within genAI responses.
First seen on csoonline.com
Jump to article: www.csoonline.com/article/4002103/cisos-beware-genai-use-is-outpacing-security-controls.html
