Cyber Risk: How Businesses Can Respond to AI-driven Data Exposure
Wed 16 Sep 2026
Approximately 612,000 UK businesses experienced a cybersecurity breach in the past year, according to the UK Government’s cybersecurity breaches survey. Meanwhile, AI risk has seen the biggest rise in concern for companies in almost all industry sectors. Patricia Egger, co-founder of Women in Cyber Switzerland and Head of Security at encrypted business cloud storage provider Proton Drive, shares her insights.
– – – – – –
Securing data has become more important for companies across industries as AI-driven exposure creates two distinct risks.
The first concerns AI that is officially used within the organisation. It has a contract and legal guarantees that the company’s data is not being used to train models or serve ads. However, this does not mean the provider will not suffer a breach, and if they do, the organisation’s data is out there regardless. It was not intentional, but the result is the same.
The second problem is what is happening outside official channels: employees using AI in their personal lives, or at work regardless of what the policy says. This is an extension of the familiar shadow IT problem. When employees use AI tools outside approved channels, it is known as shadow AI.
New AI tools are appearing every day, so it becomes hard to keep track of what is out there and what employees are using. In a business without a dedicated security function, nobody is keeping track, and that is where the exposure builds up quietly.
How Can Businesses Protect Against AI Data Exposure?
The easiest way to protect businesses from AI-driven data exposure is to practice good cyber hygiene.
Phishing – keep permissions to a minimum
Phishing attacks remain the most prevalent type of breach or attack, experienced by 38% of businesses, but the phishing threat has industrialised. Passwords were conceived in an era when phishing was largely manual. That era is over, and the answer is not stronger passwords; it is fewer passwords and in-depth defence, with authentication built on cryptographic proof rather than human memory. Keeping permissions minimal will help to reduce the attack surface.
Social Engineering – build verification habits into the culture
The vast majority of attacks involve some level of social engineering that no technology can fully fix, so build verification habits into the culture. Especially as AI is making impersonation cheaper and more convincing. Employees should feel empowered to hang up and call back through a known channel to check if a call is legitimate. Organisations should ensure all employees know their most important asset to protect, as well as the level of risk associated with their accounts and systems to help prevent social engineering attacks.
Shadow AI and oversharing – provide sanctioned and secure AI tools
The difficult part of shadow AI is that it is invisible, and that poses a real risk. You cannot secure what you do not know exists, and with new tools appearing daily, tracking what employees are experimenting with is difficult.
Employees can slip into a vicious cycle of sharing more and more with AI tools until they are handing over information they never would have shared on day one. Leaders need to interrupt that drift by providing sanctioned tools that are secure by default alongside clear, concrete norms about what goes into which tool, so employees do not need a security mindset just to do their jobs safely.
The big breaches are almost never one dramatic failure. They are many small things that seemed entirely unimportant in isolation – that together let an attacker gather intelligence or hop from one system to another. Every unsanctioned AI tool holding fragments of company data is another one of those small things, as is giving AI permission on a system. One might be nothing. A hundred nothings can become something.
Secure AI Without Slowing the Business
To secure AI use without slowing the organisation down, business leaders need to start by deciding what is actually important, because if everything is important, nothing is. For example, “important” one year may mean focusing on email and customer data, and the next year it may mean checking file permissions on all documents. Rather than trying to protect everything equally, start small, and in a year the progress compounds.
The more tools, the harder it is to keep the organisation secure. Reduce the number of tools, applications, and systems the organisation uses (and must therefore support). Keep the toolset small and permissions minimal, to keep the business as secure as possible.
Lastly, get the foundations right, because AI risk sits on top of ordinary risk. Reducing reliance on passwords and moving toward passkeys and cryptographic authentication removes a key attack vector. Pairing this with secure devices, continuous monitoring, awareness training, and basic cyber hygiene, and you treat identity, devices, and employees as equally important parts of the strategy.
