According to recent industry telemetry, the top 5% of enterprise AI users generate 12 times the traffic of the bottom half of the workforce combined.
While security teams focus heavily on policing general employee usage of frontier models like ChatGPT, a small group of power users is hardcoding unapproved tools, browser extensions, and niche models directly into daily operations.
While reviewing this research recently, we noticed a critical blind spot that most security strategies ignore. Most CISOs approach this trend by trying to govern applications, which raises a much sharper question for security leaders. We need to evaluate whether the primary risk is the application itself or the sensitive data moving through it.
Our Core Perspective at Matters:
- Focus on data, not app names: Blocking or approving websites does not protect your assets if you cannot see what information employees paste into them.
- Connect the full context: True protection happens when you look at data sensitivity, user behavior, and data movement as a single unified picture.
- Enable work without blind spots: Security should not stop employees from using AI, but it must track where sensitive data goes across cloud, SaaS, endpoints, and on-premises systems.
The Failure of Traditional App Governance in the AI Era
When generative AI entered the enterprise, the immediate playbook was application governance. CISOs created approved software lists, set up web proxy rules, blocked unapproved domains, and assumed the perimeter held.
However, that approach misses the root problem.
App-centric security tells you which tools connect to your network, but it reveals nothing about what data is entering those systems. Blocking an unapproved web interface does not stop a developer from pasting proprietary source code into an IDE extension. Setting up corporate SSO for a primary LLM does not prevent a finance lead from feeding confidential revenue metrics into a personal subscription tier linked to a company email.
Knowing which AI tools exist on your network is empty visibility. When security teams rely solely on app governance, they operate with a severe structural defect because they see connection endpoints without understanding data context.
How Unmanaged Data Movement Happens in Practice
The gap between app visibility and actual data movement becomes obvious when looking at everyday operational workflows across engineering, finance, and operations.
The Invisible Code Leak
A software engineer needs to debug a complex script under a tight deadline. Rather than navigating slow enterprise approval processes, the engineer installs an unvetted IDE extension that automates refactoring.
On a traditional network log, this connection shows up as standard and harmless API traffic. The real consequence is that proprietary source code and sensitive backend logic are leaving the enterprise boundary.
The Personal Account Exposure
A finance lead is preparing quarterly revenue projections. To speed up drafting, the analyst copies unreleased earnings figures into a personal AI tier registered under a corporate email address.
The connection looks like standard web browsing over HTTPS. The actual threat is that confidential financial metrics now sit inside an unmanaged external model repository.
Neither incident triggers traditional perimeter alerts because the tools mimic normal web activity. The security gap stems from a failure to observe data movement in context.
Connecting Sensitivity, Behavior, and Movement
Security teams face a fundamental data visibility problem alongside their AI challenges. Resolving this blind spot requires moving past static app-blocking and evaluating three elements together that are usually isolated.
Here is how security teams must evaluate risk to gain full clarity:
- Data Sensitivity: You must know whether the asset is basic public text, internal notes, customer PII, or core source code. Without clear classification, security filters treat harmless text and critical company secrets as the same thing.
- User Behavior: You need to monitor user identities, track whether they use work or personal accounts, and watch for sudden activity spikes. When an employee switches from short prompts to uploading heavy files, user context explains the risk.
- Data Movement and Activity: You must track where data starts, where it travels, and where it rests across all environments including cloud, SaaS, endpoints, and on-premises setups.
How Matters Addresses This Operational Gap:
- Shadow AI and Unmanaged Exposure: Automatically detects sensitive data like source code or financial metrics moving into unapproved browser extensions, personal accounts, and niche SaaS tools.
- Contextual Data Security: Unifies sensitive data discovery and classification with real-time user behavior and data movement across cloud, SaaS, endpoint, and on-prem environments.
Real protection requires connecting what the data means with who is interacting with it and where it travels. When security leaders map data context to user activity, AI adoption stops being a security blind spot. You no longer have to guess whether a high-volume power user is driving engineering velocity or exposing customer PII.
Enabling Innovation Without Sacrificing Data Context
Enterprise security aims to safeguard core assets while enabling employees to adopt productivity tools. Workforces will continue picking up new technologies, extensions, and autonomous agents to speed up output.
Attempting to restrict every new tool creates operational friction and drives usage deeper into shadow channels.
The path forward centers on establishing complete clarity into data context. When security leaders understand where sensitive data lives and moves regardless of what technology the workforce picks up next, the enterprise can support rapid AI adoption while keeping critical assets protected.
