As more office workers use generative artificial intelligence (AI) for their tasks, companies are growing concerned about the leakage of sensitive data. Industry officials say that since it is impossible to block such concerns at the source, strengthening security training and preparing various solutions are necessary.
According to the industry on the 27th, a survey by Samsung SDS of 1,750 employees at companies and public institutions found that 38% of respondents said they individually subscribe to generative AI services not approved by their companies and use them for work. This is 14 percentage points higher than the 24% who said they use enterprise versions such as ChatGPT provided under corporate contracts. Many companies are being exposed to "shadow AI" risk, which arises when employees subscribe to AI services at their own expense or use free versions without official company approval.
In fact, companies recently agree that the risk from shadow AI is high. As generative AI rapidly establishes itself as an essential work tool, the risks grow along with it. In the Samsung SDS survey, 43% of respondents said they use generative AI for work more than four hours a day. The average daily usage time was tallied at 3.2 hours. The proportion of those who said they use generative AI more than two hours a day quadrupled from 18% at the end of last year to 72% this year. Generative AI is being used across various fields, ranging from simple searches and basic tasks such as document creation, translation, and summarization, to high-level tasks such as data analysis, business planning, and problem solving.
In this process, the risk of information leakage has grown as personal generative AI is used instead of the enterprise versions that companies provide under formal contracts. Enterprise versions guarantee that content entered by employees is not used to train AI models, and allow usage history management and access control, but personal versions do not apply such features. An official in the system integration (SI) industry said, "Many executives say that after they opened mobile and internet networks because employee demand for AI use was high, the proportion of employees handling work on external networks rather than internal networks has increased." He added, "These executives are worried about corporate information leakage by employees using personal AI on external networks."
In particular, the more actively AI agents created by individual employees without company approval are used for work, the greater the shadow AI risk becomes. An official in the security industry said, "It is like employees without staff numbers roaming around the company doing work," adding, "With current system security, it is hard to distinguish whether a person logged in or an AI logged in."
The industry cites strengthening employees' security awareness and adopting various solutions as ways to reduce such risks. A representative example is reinforcing blocks so that various data within a company cannot leave at all. An official in the startup industry said, "As the risk of leaking personal or sensitive information grows, we expect the audit market to expand further and are developing related solutions," and predicted, "It will also take time to strengthen employees' security awareness."
