Staff AI use
Staff AI use as a resilience issue
Resilience is not only about outside attackers. The NCSC's review also flags sensitive data leaving through AI services an employer does not control.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
The warning
What the review says
Annual Review 2026 cautions that when employees use AI services nobody has approved, confidential company information can leak and the employer may lose track of how it is handled [7]. This risk comes from an organisation's own adoption of AI, and sits apart from the attacker-side forecast.
Practical rules
A short policy that works
A policy need not be long. These points cover most of the risk:
- List the AI services staff may use for work and who signed them off.
- State which data must never be entered, such as customer records or unreleased results.
- Say whom staff ask when a tool is not on the list.
- Review the list regularly, as tools change quickly.
The other side
Using AI to defend
The review says AI can help defenders find weaknesses, review alerts and respond faster, so long as automated actions have clear limits and human oversight [7]. The NCSC itself concedes that many organisations are not yet comfortable letting software take defensive action on its own [5]. If you adopt it, begin with tools that recommend rather than act.
A question for your next board paper
Do we know which AI services our staff use today, and what company data has gone into them? If not, that is the first gap to close.
Ownership
Who decides
Staff AI use sits between IT, legal, data protection and the business. Pick one owner, give them authority to approve or refuse tools, and have them report to the board on what is in use. Without a named owner the policy tends to become a document nobody applies. Put the same questions to suppliers: whether AI services process your data, and where it goes.
Keep reading
Read next
Cyber Essentials
The NCSC calls Cyber Essentials the starting point for AI-era resilience. What the 75% discount covers and what to do beyond certification.
Read the guide
Is AI-powered ransomware already hitting UK organisations?
The NCSC's AI ransomware warning is a forecast to 2028. What responders have seen so far, and what has not been confirmed.
Read the guide
What does the NCSC mean by 'highly likely'?
The NCSC uses the PHIA probability yardstick. What highly likely, almost certain and realistic possibility signal in its AI assessment.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.