Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
Harmonic analysed 22,458,240 enterprise GenAI prompts and file uploads across 665 tools and identified 579,113 sensitive exposures, with six applications accounting for 92.6% of them and ChatGPT alone for 71.2%; code, legal documents and financial data made up 74.5% of the exposed sensitive content. Cyberhaven found that 32.3% of ChatGPT usage occurred through personal accounts, and Verizon reported that 67% of AI use on corporate devices went through non-corporate accounts, with source code the most common data type submitted to external GenAI models across 858,440 DLP events.
IBM reported that one in five organisations had a breach attributed to shadow AI and that high shadow-AI usage added an average of $670,000 to breach costs. The mechanism is ordinary work, not intrusion: an employee summarises, debugs, translates or drafts using an unmanaged account, and the prompt leaves enterprise SSO, logging, retention and data-use controls. The prescribed response is approved AI routes, machine-readable data tags, pre-submission policy checks and sanitised telemetry.
Why this analysis has no ERS
There is no assessed AI deployment. The brief is a cross-vendor population study — Harmonic's telemetry over 22,458,240 prompts and uploads across 665 tools, plus Cyberhaven, Verizon DBIR and IBM breach-cost figures — measuring how enterprise data flows out through employee use of unmanaged third-party AI accounts. The systems receiving the data (ChatGPT, Gemini, Claude, Copilot, Perplexity and 660 others) are not deployments the assessed organisation configures, and the brief supplies no evidence about any of their intrinsic security properties; it measures the volume and category of data leaving governed paths. AITBM scores a specific system in a specific configuration, and 'shadow AI' is precisely the condition of there being no assessed configuration to score. Forcing an architecture class, tier, IVP or ORP onto a 665-tool population would fabricate a system that does not exist. The findings belong instead as evidence inputs to the assessment of the organisation's *governed* AI paths — chiefly Pr-3 (data minimisation), Cn-1 (scope enforcement at the egress boundary), Tr-3 (audit trail completeness), Cn-5 (account and workload identity) and the ORP Attack Surface dimension.
Status: Not scorable by design · Classification: Research · source date 2026-06-24
AIDEFEND evidence routes
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-001.004 | AI Service & Embedded SaaS AI DiscoveryParent AID-M-001 (AI Asset Inventory & Mapping). Discovery of externally hosted and embedded AI services is the prerequisite for every other control here; in an AITBM assessment of a governed deployment it would feed Tr-4 lineage and Cn-5 account/workload identity evidence. | High | Fa-3 Tr-4 Cn-5 |
| AID-I-002.002 | Secure External AI Service ConnectivityParent AID-I-002 (Network Segmentation & Isolation for AI Systems). Applies only where devices and connections sit inside a governable path; would evidence egress-boundary controls in a governed-deployment assessment. | High | Cn-4 |
| AID-H-029.001 | Data-Use Policy Schema, Tagging & ClassificationParent AID-H-029 (AI Data-Use Authorization & Lifecycle-Stage Boundary Enforcement). Machine-readable data-use tags are the direct Pr-3 evidence source for any AITBM assessment of the organisation's approved AI route. | High | Pr-1 Pr-3 Pr-4 |
| AID-H-029.002 | Lifecycle-Stage Authorization GateParent AID-H-029. A fail-closed pre-inference gate; the brief notes it governs only controlled enterprise paths and is not an answer for fully bypassed routes. | High | Pr-1 Pr-3 Pr-4 |
| AID-D-005.001 | AI System Log Generation & CollectionParent AID-D-005 (AI Activity Logging, Monitoring & Threat Hunting). Structured, redacted logs capturing tool, account type, data category, destination and policy decision are the Tr-3 evidence artefact. | Medium | Tr-3 Cn-7 |
| AID-D-005.002 | AI Detection Rule Lifecycle, Delivery & HealthParent AID-D-005. Rule health and delivery assurance; in ACI terms this is C_monitor evidence for a governed deployment rather than an IVP score. | Medium | Tr-3 Cn-7 |
| AID-DV-002 | Honey Data, Decoy Artifacts & Canary Tokens for AIParent AID-DV-002 maps directly to Pr-1 in the reconciled AIDEFEND dataVersion 2026.10.15 crosswalk. Its practical value here is attribution evidence after the fact, not prevention. | Medium | Pr-1 |