South African firms adopting artificial intelligence (AI) at pace risk losing control of sensitive information as staff feed proprietary documents, financial records and credentials into tools beyond the organisation’s oversight. The trend is creating a fresh security gap: businesses often know where data is stored, but not where it goes once AI services enter the workflow.
Scale and scope of the problem
International surveys cited in recent industry reporting show the problem is wide-ranging. Microsoft’s Data Security Index attributes 32% of incidents experienced by respondents to generative AI use. Morgan Stanley’s 2026 global research found that around 90% of companies viewed data as their most common risk source, with 56% of firms linking that risk to their use of AI — yet only 41% said they had a complete inventory of the AI models in use with clear ownership assigned.
| Measure | Statistic | Source |
|---|---|---|
| Incidents linked to generative AI | 32% | Microsoft’s Data Security Index |
| Firms citing data as main risk | 90% | Morgan Stanley (2026) |
| Firms linking that risk to AI | 56% | Morgan Stanley (2026) |
| Firms with inventory of AI models | 41% | Morgan Stanley (2026) |
| Initial access via valid accounts | 20% | Microsoft’s 2026 Digital Defense Report |
For South African small and medium-sized enterprises (SMEs), which often lack dedicated security teams, these figures underscore a practical exposure: employees experimenting with public AI chatbots or third-party automation platforms may inadvertently transmit customer details, contract terms, pricing strategies and other commercially sensitive material out of corporate control.
How traditional threats meet AI
AI has not removed established cyber risks; it has reshaped them. Microsoft’s 2026 Digital Defense Report shows that valid, compromised accounts still account for 20% of initial access incidents. Criminals can monetise stolen credentials to gain entry to business systems, and a compromised AI account can reveal uploaded files, prior prompts and conversation histories — a rich source of intelligence for targeted fraud or theft.
- Untracked AI use: staff may use dozens of public or niche AI tools not approved by IT.
- Data leakage: prompts and uploaded files can persist in third-party systems.
- Credential theft: stolen logins give attackers access to both corporate systems and any connected AI services.
Without a reliable inventory of tools and model ownership, firms cannot assess exposure or enforce consistent controls. That gap elevates risks to consumers whose personal data could be exposed, to investors if intellectual property leaks, and to employees if job-critical information or trade secrets are disclosed.
What this means for budgets and jobs
For businesses, the short-term cost is operational uncertainty: increased monitoring, incident response and potential regulatory notification obligations if personal data is involved. Over the medium term, firms may face higher insurance premiums and compliance expenses as insurers and regulators demand clearer governance. For households, the transmission chain matters — data breaches lead to direct financial harm in fraud cases and indirect costs as firms raise prices or cut staff to cover security investments.
SMEs are particularly vulnerable. Many adopted AI quickly to boost productivity and compete with larger firms, but without matched investment in security. That leaves smaller employers balancing the potential efficiency gains from AI against the cost of securing a distributed technology stack.
Practical steps firms should consider
Industry reporting suggests several immediate actions companies can take to reduce exposure:
- Create a central inventory of AI services and models in use, assigning ownership and accountability.
- Develop clear rules for what can be shared with external AI tools and provide approved, secure alternatives.
- Harden access controls and monitor for compromised credentials, including multifactor authentication and regular password hygiene.
- Train staff about the permanence of prompts and the risk of uploading sensitive files to third-party services.
Organisations that move early to map their AI landscape can better weigh efficiency gains against the cost of governance. As the adoption of generative AI accelerates, the careful question for South African business leaders is not whether to use these tools, but how to use them without creating new, unmanaged channels for their most valuable data.
WE NEWS does not provide financial or legal advice.
