77% Are Pasting Data Into GenAI. Most Companies Won't Know for 247 Days.
IBM's 2025 Cost of a Data Breach Report surfaced two numbers that deserve to be read together.
77% of employees are pasting company data into generative AI tools. When that exposure becomes a breach, organizations take an average of 247 days to detect it.
That pairing tells you everything you need to know about where enterprise AI risk stands right now.
77%: Adoption Already Happened
Nearly eight out of ten employees are using generative AI as part of how they work. They're pasting customer emails into AI to draft responses, dropping financial data in to create summaries, feeding proprietary code into models to troubleshoot, and uploading internal documents to move faster on proposals.
They're not trying to cause harm. They're trying to do their jobs.
The problem is that most generative AI tools operate completely outside enterprise security monitoring. They don't recognize data classification levels or regulatory boundaries. They process whatever they're given.
77% means this is already the norm at most organizations. The question is no longer whether it's happening. It's whether you know when it does.
247 Days: The Cost of Not Knowing
In eight months, exposed data doesn't sit still. It gets copied, reformatted, re-summarized, and redistributed. Customer PII spreads. Intellectual property gets embedded into AI-generated outputs. Sensitive business context moves far beyond where it started.
By the time most organizations discover a problem, it's no longer a contained mistake. It's accumulated risk.
What makes AI-related exposure so hard to catch is that it looks nothing like a traditional attack. There's no malicious payload, no exploit signature, no suspicious login. There's a logged-in employee with legitimate access in a normal browser session using copy and paste. From a legacy security standpoint, nothing looks wrong.
That's exactly the problem.
The Gap Between Those Two Numbers Is Where You're Exposed
77% tells you data is moving into AI tools constantly. 247 days tells you most organizations have no real-time visibility into it. That gap is not a policy problem -- it's a visibility problem.
When an employee pastes sensitive data into an unauthorized AI tool, the signal exists immediately. The transfer is observable. The content risk can be evaluated in real time. Waiting 247 days to find that event is not a technology limitation. It's an architectural one.
Why InnerActiv Changes the Equation
InnerActiv monitors AI tool usage at the endpoint level, which means your security team sees activity the moment it happens -- not months later.
When an employee pastes data into a GenAI tool, InnerActiv captures it, analyzes the content against your policies in real time, and surfaces the risk so your team can act immediately. Whether that means triggering an automated response, alerting a security analyst, or blocking the transfer entirely, you're making decisions based on what's actually happening right now.
Here's what that looks like in practice:
A sales rep pastes a customer contract into ChatGPT to pull out key terms. InnerActiv flags the transfer, identifies the document as containing PII and contractual data, and alerts the security team within seconds -- before the session ends and the data is processed by an external model.
A developer copies proprietary source code into an AI coding assistant to debug a function. InnerActiv detects the content, evaluates it against your IP protection policies, and can automatically block the transfer or notify the user that the action violates company policy.
In both cases, the event is visible, the risk is understood, and the response happens in real time. Not in 247 days.
The difference between those two timelines isn't just faster detection. It's the difference between containing a risk and cleaning up after one.
Only 1 in 5 Employees Know Your AI Policy. That's Everyone's Problem.
Only 1 in 5 employees using AI at work can point to a company policy that tells them how to do it safely. That means 4 out of 5 are making their own decisions about what to share, which tools to use, and where your data goes. And most of them aren't doing it maliciously. They just have no idea there's anything to worry about.
Layoffs Are an HR Event. They’re Also a Security Event.
The moment a termination notice goes out, the clock starts ticking. Employees who are about to lose their jobs, or who already know they're on the list, don't always wait to be escorted out before they start moving data. And in a workplace where AI tools can summarize, package, and transfer large volumes of information in minutes, that data moves faster and leaves a smaller trail than it ever has before.
Paid Insiders Are the New Attack Vector. AI Is Making It Worse
A recent article from Cybersecurity Insiders highlighted an emerging trend: threat actors are actively recruiting employees inside telecommunications providers, banks, and technology companies, offering direct payment for access to systems, data, or operational assistance. Rather than hacking in from the outside, attackers are increasingly buying legitimate access from within.
