Only 29% of Security Teams Can Audit GenAI Data Flows

Only 29% of 433 IT and security professionals said their teams could routinely produce a report showing how many times sensitive data reached generative-AI tools in the previous 30 days, according to the Cloud Security Alliance’s 2026 survey report, DLP in the AI Era. Jazz commissioned the research.

CSA asked whether teams could produce a report showing "how many times sensitive data was sent to GenAI tools in the past 30 days." The survey ran in June and July. Respondents also treated GenAI as their top data-exfiltration risk, with 48% placing it among their top three.

How confident are teams in their GenAI visibility?

Just over half of respondents rated their visibility into GenAI at 4 or 5 out of 5. Yet only 29% could back that confidence with a routine report that counted sensitive-data transmissions to AI tools over the prior 30 days.

Enforcement did not close the gap. Only 22% strictly blocked sensitive data on the GenAI channel. Removable media, which respondents ranked as their lowest exfiltration risk, had the highest strict-block rate at 31%. CSA said strict blocking clusters around channels with the oldest tooling.

The survey turns AI governance into a basic audit test: teams can rate their exposure without showing a reliable count of it.

Why does an approved-tool list miss most activity?

Jazz telemetry from customer environments showed an average of 169.5 distinct AI tools in use at each organization. Only 9.8 were approved, leaving 94.2% outside the approved list.

The conventional response has been to approve a few AI services under enterprise agreements and discourage or block the rest. The report says procurement for an approved service can take weeks, so engineers facing a deadline may use whichever tool solves the immediate problem.

An inventory records no events. To answer an incident-team or auditor’s questions, teams need four pieces of evidence:

• What sensitive data was involved, and where did it come from?
• Which tool received it?
• Which account did it pass through?
• Why did the person send it?

The account often breaks tool-level governance first. The same website can serve a company’s enterprise account, with retention settings and contract terms, or an employee’s free personal account, which has neither. Approved use through a personal login can leave evidence as thin as unapproved use.

Purpose requires context that never appears in the payload. The report contrasts a finance analyst pasting a revenue model into a chatbot to fix a broken formula with an employee who submits notice on Friday, then pastes the same material.

Approved tools can therefore supply a roster without supplying accountable evidence.

Can existing controls identify risky AI use?

CSA found no dominant control strategy. Network-level blocking of AI domains, browser-based content inspection and acceptable-use policy alone each drew between 21% and 23%, while enterprise AI platforms with built-in DLP drew 10%.

Each approach inspects one point in the data path:

• A domain block records the destination and allows or stops the connection.
• A browser extension sees what is typed into that browser, but misses desktop apps, a coding assistant inside a code editor and command-line tools.
• Built-in DLP on an enterprise AI platform sees only what enters that platform.

The survey analysis says a control that cannot distinguish a corporate account from a personal one, or a routine paste from a risky one, must block both or neither. That stops legitimate work alongside risky work.

Respondents cited the enforcement tradeoff. Forty-six percent said fear of disrupting business workflows was the main reason they had not moved more aggressively to active blocking, while 39% cited insufficient confidence in DLP accuracy.

Single-point controls explain why strict enforcement remains limited even among teams that rank AI among their top risks.

How broadly do these findings apply?

The survey results are self-reported, and CSA did not test visibility ratings against actual coverage. Respondents skewed toward the Americas, at 80%, and toward organizations with fewer than 5,000 employees, at 67%, so the results may not transfer evenly to large global enterprises.

The telemetry has a second selection effect. It comes from organizations that chose to deploy this kind of visibility, which may overrepresent businesses already concerned about AI sprawl.

Those limits make the 29% figure a benchmark for the visibility problem, not a universal rate for every enterprise.

Will approved products and agents weaken the evidence further?

As approved SaaS products add AI assistants, the receiving tool can have two identities: the application the employee opened and the model provider behind it. AI agents add another layer because software may pull a file and send it somewhere on an employee’s behalf.

A recent Unite.AI analysis of prompt injection in production agents argues that an agent can be steered by content it reads. Its own account of its actions therefore cannot substitute for evidence of purpose.

Approved agents will push security teams beyond tool governance toward event-level evidence.

What can security teams test this month?

The report recommends a 30-day test: select the most sensitive data that teams believe reached an AI tool, then determine whether they can answer four questions without building the answer by hand.

• What was the data, and where did it come from?
• Which tool received it, including tools outside the approved list?
• Did it pass through a corporate or personal account?
• What was the person working on when they sent it?

If teams can retrieve the first two answers quickly but need employee interviews for the last two, their governance covers the tool roster and little of the data movement behind it.

Over the next 30 days, that test will show whether enterprises can turn tool inventories into event-level evidence before approved agents make the gap wider.