Security professionals worry more about employee AI data use than AI attacks

O’Reilly surveyed 209 security professionals in September 2026 and found that staff entering company information into AI tools worries them more than attacks carried out with AI. Nearly half of respondents, 49%, said data leaking through commercial AI tools was a primary concern. More than half said colleagues now and then put sensitive information into AI tools their employer had not approved.

UpGuard’s State of Shadow AI report, published Nov. 10, 2025, found that eight out of 10 employees use shadow AI, meaning AI tools their employers have not authorized. The research also found that 68% of security leaders, including chief information security officers, rely on unauthorized AI as part of their daily routine.

Security leaders at organizations with more than 200 employees were about 50% more likely than other senior leadership to rely on shadow AI, according to UpGuard surveys running Aug. 18-31, 2025 and July 30-Aug. 11, 2025. UpGuard also found that 23% of chief information security officers knew that credentials and passwords were shared with AI tools inside their firms. The study examined the prevalence of unapproved AI usage across organizational levels.

Company policy strength changed the picture. At firms with comprehensive AI policies, 17% of security professionals reported widespread shadow AI use, while the figure rose to 35% at firms with only basic policies; the O’Reilly survey examined how policy strength affects unauthorized AI use. UpGuard’s Greg Pollock said, “Our data shows that increased security training and literacy does not curtail increased shadow AI usage; in fact, it increases it.”

UpGuard research suggests that more training and literacy can grow shadow AI use by producing AI power users. The same report found that 41% of employees get around application blocking to use AI, which the report presents as evidence that blocking measures often fail to prevent unauthorized use.

Employees also trust the tools more than people: UpGuard found that 27% of employees put more trust in AI tools than in their coworkers or managers when looking for reliable information. Separately, 49% of O’Reilly respondents worried about staff relying on AI-generated output that had not been verified.

AI-generated phishing reached most teams without alarming them: 55% of respondents had encountered it in the past year, but only 25% listed it as a top concern. Security professionals also named AI agents with too many permissions or no clear owner as a leading worry.

The defenders use the technology too. Two-thirds of security professionals turn to copilots or chatbots for documentation and research, while roughly 25% put AI to work on incident response or threat detection.

The SANS Institute’s 2026 Security Awareness & Culture Report placed AI second among human risks in the workplace, behind only social engineering. The same report found that 75% of security awareness teams use AI tools to run and build their own awareness programs. SANS also noted that practitioners are increasingly integrating AI into their own workflows.

The average salary for security awareness professionals reached $123,624 in 2026, roughly $7,000 higher than the previous year. SANS said staffing levels often remain insufficient. The Pew Research poll from 2025 found that concerns about AI misusing personal data reached 71% of adults in the US.

Verizon’s 2025 DBIR puts the human element in 60% of cybersecurity incidents. Under NIS2, organizations that cannot show effective insider threat controls risk fines of up to 2% of global turnover.

Jonathan Kreiner of ORION Security named employees’ use of sensitive company data as the top immediate AI security risk for most companies, in comments dated Aug. 21, 2026. Mike Loukides put the view more bluntly: “Security professionals are paid to be cynical.”