Your Employees Are Using ChatGPT. But Is Your Company Data Safe?

Probably not completely, and you may not know what has already left. Microsoft and LinkedIn's 2024 Work Trend Index found 75% of knowledge workers use generative AI at work and 78% of them bring their own AI tools rather than company-approved ones. IBM's 2025 Cost of a Data Breach Report found 20% of organisations had a breach linked to this "shadow AI", adding about US$670,000 to the average breach cost, and 63% of breached organisations had no AI governance policy. The fix is not a blanket ban, which staff route around, but a mix of approved tools, a clear policy and network controls that show which AI apps are in use and stop sensitive data leaving. A Fortinet FortiGate can identify and control AI applications on your network; the FortiGate 50G with 1-year Unified Threat Protection (UTP) is S$1,819.20 at SourceIT (listed 30 Oct 2026).

How big is the shadow AI problem?

Figures from the named reports. IBM's 2026 report, as covered by several outlets, says shadow AI incidents rose further; we cite the 2025 figures, which we confirmed from IBM directly.

What actually goes wrong?

The best-known case is Samsung, which in 2023 restricted generative AI tools on company devices after staff reportedly pasted confidential source code into ChatGPT. The risks are usually more mundane:

• Confidential data in prompts. Contracts, customer lists, salary files and code pasted into a personal AI account sit outside your control and retention policy.
• Personal data and the PDPA. Sending customers' personal data to an unapproved service may breach your obligations under Singapore's Personal Data Protection Act, which carries penalties of up to 10% of Singapore turnover for larger organisations or S$1 million.
• Personal accounts. When someone leaves, their chat history with your data leaves too. See Your Ex-Employee Might Still Have Access to Company Data.
• Wrong answers acted on. AI output pasted into a client report without review is a quality risk as well as a security one.

Our post Your Company Data Is Feeding AI. Do You Even Know Where It Goes? covers what happens to data inside AI services.

You cannot protect data from a tool you do not know your staff are using. Visibility comes before policy.

What can a FortiGate do about it?

• See which AI apps are in use. FortiGate application control identifies generative AI applications by signature. Application control is included with any FortiCare support contract, and Fortinet's FortiOS 7.6 administration guide has a section on protecting generative AI access with it.
• Allow, limit or block. Allow the AI tool your company has approved, block personal or unknown ones, or allow access but block file uploads.
• Filter by category. Web filtering (in the UTP and Enterprise bundles) can manage AI sites as a category, which helps with new tools that appear every week.
• Stop sensitive data leaving. Data loss prevention (DLP) can watch for patterns such as NRIC numbers or card numbers. Fortinet lists the FortiGuard DLP service in the Enterprise Protection bundle.
• Look inside the traffic. AI services run over HTTPS, so many controls need SSL deep inspection to see prompts and uploads.

Two caveats. Fortinet says inline CASB, a feature for finer control of cloud apps, is not available on the 30G and 50G series, so offices that need it should look at larger models. And on 26 October 2026 Fortinet announced a new FortiGuard Inline AI Security Service that inspects prompts and responses and masks sensitive data; its licensing and availability had not been published when we wrote this.

What should the policy say?

1. Name the approved tools and provide them, ideally business accounts with data protection terms, so staff have no reason to use personal ones.
2. Define what must never go into AI: personal data of customers and staff, client confidential information, passwords and source code, unless the tool is approved for it.
3. Require human review of AI output before it goes to clients.
4. Block the rest at the network and review the application logs monthly for new AI tools.
5. Train staff with real examples rather than a one-page memo.

For broader context, read Are Businesses Becoming Too Dependent on ChatGPT? and Your Company's Biggest Cybersecurity Threat Could Be an AI Tool Your Staff Loves.

Buying in Singapore

SourceIT supplies FortiGate firewalls with local warranty and a GST invoice, including the FortiGate 50G (S$1,819.20 with 1-year UTP), FortiGate 70G (S$2,630.40) and FortiGate 90G (S$6,094.80), and Microsoft 365 business plans for approved AI and collaboration tools. Prices listed 30 Oct 2026; ask us about Enterprise Protection bundles for DLP. Browse the FortiGate firewall collection or Microsoft 365 for Business. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is shadow AI? The use of AI tools at work without the company's approval or oversight, often through personal accounts. Microsoft's 2024 Work Trend Index found 78% of AI users bring their own tools.

Is it safe to put company data into ChatGPT? Only through an account and plan your company has approved for that data. Personal accounts sit outside your control, and personal data may raise PDPA issues.

Can a FortiGate block ChatGPT? Yes. FortiGate application control can identify, allow or block ChatGPT and other generative AI apps. Application control is included with FortiCare support.

Can a firewall stop staff pasting sensitive data into AI tools? Data loss prevention can detect patterns such as NRIC or card numbers in traffic, usually with SSL inspection. Fortinet lists its DLP service in the Enterprise Protection bundle.

Should we ban AI tools altogether? Usually not. Bans push use onto personal devices. Approve suitable tools, set clear rules on data, and block the rest.