Study: Half of security teams ranked Gen AI as top exfiltration risk. Just 16% had tools in place to prevent it

October 23, 2026

Sponsor ad - 728w x 90h (at 72 dpi)

A survey from the Cloud Security Alliance (CSA), conducted in collaboration with Jazz, found that data loss prevention (DLP) tools are more likely to see losses after-the-fact, rather than preventing it as intended.

73% of responding organizations said they experienced at least one confirmed data loss incident in the past 24 months. Among the respondents, only 16% said DLP blocked their most significant incident before data left the organization.

Piracy Monitor Supporter

Key findings

Modern risks lack modern enforcement. The highest-ranked risks are among the least strictly enforced, and the lowest-ranked are among the most strictly enforced. Both GenAI (48%) and cloud storage uploads (41%) were cited as top exfiltration risks, but only 22% of organizations strictly block on GenAI and 19% on cloud storage uploads. Conversely, removable media, which ranked last (10%) as an exfiltration risk, is strictly blocked by 31% of respondents, the highest strict-block of any channel measured.
Perceived visibility exceeds demonstrated capability. Less than a third (29%) are able to produce a routine 30-day report showing sensitive data sent to GenAI tools.
DLP alert overload fuels fatigue. Fifty-four percent of teams are triaging DLP alerts where the majority turn out to be false positives, and 90% report at least one measurable impact from alert fatigue in the past year, including 21% who report voluntary staff departures directly attributable to DLP alert burden.
Business friction determines enforcement posture. 71% reported that their security teams received pushback on DLP enforcement during the past two years. Among those teams, 66% reduced enforcement for specific teams/use cases; 8% reduced enforcement broadly across the organization; and 3% reduced or paused the program entirely. Across the full respondent base, 54% softened enforcement in some form.

Methodology

The survey was conducted online by CSA in June and July 2026 and received 433 responses from IT and security professionals. Respondents represented organizations ranging from fewer than 1,000 to more than 50,000 employees and were primarily located in the United States and Canada. Jazz funded the research and co-developed the questionnaire with CSA research analysts, while CSA independently performed the data analysis and interpretation.

Why it matters

“Enterprise Data Loss Security has moved beyond the question of whether it should be deployed to whether it’s doing what it is intended to do. Enforcement is being softened, analyst capacity is consumed by noise, and new data-exit channels created through GenAI are exposing gaps legacy DLP was never meant to handle,” said Hillary Baron, AVP/Research, Cloud Security Alliance. “In the AI era, where employees and applications can move sensitive data through more channels than ever, organizations can’t afford to discover gaps after the fact.”