Ziad Nasr is the General Manager for Acronis Middle East.

[For more news, click here]

Fourteen percent of employees now use generative AI every working day, and that group reports productivity gains at more than double the rate of occasional users. 92% versus 58%, according to PwC's 2025 Global Workforce Survey. More than half the global workforce has used AI in their role in the past year. This is not a pilot phase. GenAI is now a standing part of how work gets done, in the same category as email or search. Something employees reach for without asking permission, because asking would be slower than just doing it.

That instinct is also the problem. A financial advisor pastes a client's portfolio into ChatGPT to draft a rebalancing summary. A nurse pastes a patient history into a chatbot to shorten a discharge note. A product manager pastes a pricing model into Copilot to reformat it for a board deck. None of these people are trying to leak anything. Each is doing the fastest version of a task they were already going to do, and that fastest version happens to route sensitive data through a third-party model.

LayerX's 2025 Enterprise AI and SaaS Data Security Report puts a number on the pattern. Employees average 14 pastes a day into non-corporate GenAI accounts, and at least three contain sensitive data. Intent stays good. Outcome doesn't.

Policy is necessary, but not sufficient

The instinctive response is to write a policy. Name the sanctioned tools, name the prohibited data types, tell people what not to paste. This is correct, and it is also a rerun of a story security teams already know the ending to.

Enterprises wrote acceptable use policies for email in the 1990s. They named prohibited attachments, prohibited recipients, prohibited content. Employees read them, mostly agreed with them, and kept BCCing client lists to personal Gmail accounts anyway, not out of malice, but because the policy lived in a document and the workaround lived one click away. The industry's answer wasn't a better-written policy. It was email DLP, software sitting in the actual send path and inspecting content before it left the building, regardless of what the policy PDF said. Policy told people what the rule was. Only inspection enforced it at the moment someone was about to break it.

GenAI is running the identical arc, compressed. The policy step is already tablestakes, and all of it has a ceiling, because none of it acts on the one moment that actually matters, the moment an employee has already decided to paste. A policy is a prediction about behavior. It is not a control on behavior. Necessary, not sufficient. The gap between those two words is where the leakage happens.

Control at the point where intent turns to action

Here is the technically inconvenient part. The action that actually causes GenAI data leakage isn't a file upload or a network request in any conventional sense. It's a clipboard paste into a browser text field, inside a session that's almost certainly already TLS encrypted. That single fact quietly defeats most of the security stack. DNS and proxy controls see that an employee opened chat.openai.com, but they cannot see what got pasted into it, because the content never traverses as a distinct, inspectable request. It's typed or pasted directly into a page the browser already trusts. The clipboard event is invisible to almost every control upstream of the endpoint, which is exactly why classifying data and training employees, sound as those steps are, will never stop this specific action.

This is the reason why the endpoint is the only place this control can actually work. The network already lost this fight, for the reason above. An encrypted session gives a proxy nothing to read even if it wanted to. The browser has a similar gap. An extension can see a page render, but a personal account inside a sanctioned browser looks identical to a corporate one until the content itself is inspected, at which point it's doing the same job the endpoint would do anyway, just with a narrower view of the machine. File-based tools fail earlier still, because a pasted prompt was never a file. Nothing was created, saved or moved, so there is nothing for a file scanner to find.

That leaves the device itself as the last point where the content exists in a form anyone can inspect before it leaves. Whatever an employee types or pastes has to pass through the operating system on the way to the browser, which means the endpoint is the one place the words are still local, still readable and still stoppable. It's also the only layer that doesn't care which account is being used or which tool the prompt is headed to, since it's reading the content rather than trying to identify the destination. That's what makes it structurally different from every control upstream of it, not a better version of the same idea, but the only version that is actually positioned at the moment of exposure.

Speed matters here in a way it doesn't earlier in the chain. Policy, classification and training can afford to be slow, because they operate before the moment of risk. A control sitting at the point of paste doesn't have that luxury. It has to read the content and let a harmless prompt through in the same instant it stops a dangerous one, or employees will treat it the way they treated the clumsy email filters of a decade ago and route around it. Done well, that quietly keeps the sanctioned tool as the easy path instead of pushing people onto a personal device, which is exactly the outcome a security program is trying to avoid.

The center of gravity has to move

None of this makes policy, classification or training optional. Skip them and the endpoint control has no rules to enforce. The human element remains a big driver of breaches, and no amount of endpoint tooling changes that on its own. But the industry keeps talking as if writing the policy is the hard part. It isn't. The hard part, and the part worth a security program's real investment, is building the technical capability to act at the exact moment an employee's intent becomes an action a model can no longer un-see.