Violations of data guidelines involving generative AI have doubled
The new Netskope Cloud & Threat Report 2026 for the DACH region warns that while the use of generative AI (GenAI) is increasing threefold, data security is lagging behind. «Legacy risks» such as phishing and insider threats remain critical.
Despite attempts to control AI usage through official company tools, the recently published Cloud and Threat Report 2026 Netskope Threat Labs has identified a worrying trend: the number of data security policy violations related to AI applications has more than doubled compared to last year. The risk posed by shadow AI remains high, as employees continue to feed large amounts of sensitive data into unprotected channels. The Netskope Cloud and Threat Report 2026 is based on anonymized data collected worldwide via the Netskope Security Cloud platform. It analyzes trends in cloud usage, AI adoption, and the global threat landscape.
AI boom overtakes security measures
The report shows explosive growth. While the number of users of SaaS GenAI applications tripled last year, the intensity of use increased dramatically. The number of prompts sent rose sixfold. Of particular concern is the fact that Despite increased efforts by IT departments, 47% of users continue to use private AI accounts for business purposes. As a result of this shadow AI, companies record an average of 223 incidents per month in which sensitive data is sent to AI apps. Among the top quarter (25%) of the companies surveyed, the figure is even higher, at over 2,100 incidents per month.
The report shows further relevant results:
- Gemini is in the fast lane: Google Gemini experienced massive growth, with its usage rate rising from 46% to 69%. Netskope predicts that Gemini will replace ChatGPT as the most widely used AI platform in businesses in the first half of 2026.
- Dangerous data leaks: Source code (42 %), regulated data (32 %), and intellectual property (16 %) are the most common types of sensitive information uploaded to AI tools.
- Insider risk «Personal apps»: 60% of all insider threats are related to the use of private cloud instances (such as Google Drive or OneDrive), with the use of GenAI tools massively increasing this risk. Particularly worrying: 54% of data policy violations involve regulated data (financial, health, or personal data).
Agentic AI and MCP
Netskope warns that 2026 will see increasing complexity due to agentic AI. These are AI systems that autonomously perform complex tasks across various company resources. «Agentic AI creates a whole new attack surface,» says Ray Canzanese, Director of Netskope Threat Labs. «When autonomous agents gain access to internal data, misconfigurations or malicious prompts can lead to massive data leaks in milliseconds.» The trend toward AI-driven browsers and the Model Context Protocol (MCP) is also classified as a critical security risk for 2026.
Recommendations for action
The report recommends a four-step protection plan for companies:
- Complete inspection: Inspection of all HTTP/HTTPS traffic, including AI traffic.
- App governance: Blocking high-risk tools with no business purpose (e.g., ZeroGPT, DeepSeek).
- DLP focus: Use of data loss prevention to protect source code and passwords from being leaked into AI models.
- Isolation: Use Remote Browser Isolation (RBI) for risky or new domains.
Source: Netskope
This article originally appeared on m-q.ch - https://www.m-q.ch/de/verstoesse-gegen-datenrichtlinien-mit-generativer-ki-haben-sich-verdoppelt/
