[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGVUhY8pUxcM-NUJfYv-aBNjvrR70BIhb-c0j0eJJj4A":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"0630742d-79a1-4c66-a8b4-a7484a0a1196","Employees using personal ChatGPT at work? Here's what IT admins need to do","employees-using-personal-chatgpt-at-work-here-s-what-it-admins-need-to-do-399499","Employees using personal ChatGPT accounts at work can expose sensitive company data, even when their organization provides an approved Enterprise workspace. NordLayer explains how IT teams can investigate unauthorized AI use and block sensitive information before it reaches personal accounts. [...]","Employees using personal ChatGPT accounts at work pose a significant data security risk, even if their organization has an enterprise version. Sensitive information like customer data or internal documents can be inadvertently exposed. IT administrators need tools like NordLayer AI Scout to monitor AI tool usage, identify personal account use, and block sensitive data from being submitted to unauthorized AI platforms.","IT admins must monitor and block employee use of personal ChatGPT to prevent sensitive data leaks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Femployees-using-personal-chatgpt-at-work-heres-what-it-admins-need-to-do\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F10\u002F12\u002Fchat-prompt-header.jpg","2026-10-16T13:50:59+00:00","2026-10-16T16:00:06.706021+00:00",7,[17,20,22,25],{"name":18,"type":19},"ChatGPT Enterprise","product",{"name":21,"type":19},"AI Scout",{"name":23,"type":24},"NordLayer","vendor",{"name":26,"type":27},"AI","technology","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":28,"icon":30,"name":31,"slug":32},null,"AI Security","ai-security",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,18,21],{"controls":54,"vendors":130},[55,76,102],{"slug":56,"name":57,"problem":58,"products":59},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[60,68],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,89,94],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":90,"product_name":91,"url":92,"description":93},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":32,"name":103,"problem":104,"products":105},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":149},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","Employees using personal AI accounts in the workplace represent a modern form of 'shadow IT,' where sensitive organizational data — including customer records, financial information, and internal documents — can be inadvertently submitted to unauthorized platforms outside corporate controls. Unlike enterprise AI subscriptions, personal accounts typically lack data retention controls, privacy guarantees, or audit trails required by most compliance frameworks. This creates significant legal and reputational risk, especially under regulations like GDPR, HIPAA, or CCPA. The core problem is a gap between employee convenience and organizational policy, compounded by a lack of technical enforcement mechanisms to detect or block unauthorized AI tool usage.",[136,137,138,139,140,141,142,143,144,145,146,147,148],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 3 – Data Protection","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-53 AC-2 – Account Management","NIST SP 800-53 AC-22 – Publicly Accessible Content","NIST SP 800-53 SI-12 – Information Management and Retention","NIST SP 800-53 MP-7 – Media Use","GDPR Article 5 – Principles Relating to Processing of Personal Data","GDPR Article 32 – Security of Processing","GDPR Article 28 – Processor Obligations","ISO\u002FIEC 27001 A.8.1 – Responsibility for Assets","ISO\u002FIEC 27001 A.13.2 – Information Transfer Policies",{}]