Finance workers share sensitive data with AI tools

CybSafe and the National Cybersecurity Alliance said 42% of finance and insurance workers who use AI at work have shared sensitive work information with AI tools without their employer's knowledge. The figure comes from the latest edition of the organisations' Oh Behave! research.

The finding adds to the debate over AI oversight in financial services. It focuses on routine employee behaviour rather than model design or procurement decisions.

The research surveyed 221 workplace AI users employed in finance and insurance. It forms part of the 2026-2027 Oh Behave! report, which examines cybersecurity attitudes and behaviours across five countries.

Financial institutions face growing scrutiny over how they govern AI use in daily operations. Regulators and industry groups have paid closer attention as firms deploy AI tools across compliance, operations and customer-facing work.

One concern is that staff may paste client, commercial or internal information into external systems without formal approval or clear records. This creates a gap between written policy and actual practice inside firms.

"Financial firms handle information that customers trust them to protect. Understanding how that information is used with AI is an essential part of managing the risk. People need clear guidance and practical support to work safely. Leaders also need evidence of what happens in day-to-day work, so they can identify where controls need to improve," said Oz Alashe MBE, Chief Executive Officer and Founder of CybSafe.

The comments point to a broader challenge for firms trying to expand AI use while maintaining established controls around data handling. Many financial groups have issued internal guidance on approved tools, but monitoring real-world use remains uneven.

That tension is also surfacing in discussions about more advanced forms of AI deployment. Firms are testing AI agents across financial operations, where systems often remain fragmented and staff still spend time moving between platforms and resolving exceptions.

"The challenge for financial institutions is making AI work at scale and proving its value. Firms have spent years automating individual tasks, but there's a much bigger opportunity in getting agents to work together across different processes," said James Maxfield, Chief Commercial Officer of Duco.

Maxfield said the industry should focus on workflow impact rather than the number of tools introduced.

"In financial operations, teams still spend hours moving between systems, investigating exceptions and chasing missing information. AI agents can take on much of this legwork, but they need reliable data, proven controls and human oversight to do it safely," he said.

The comments reflect a growing industry view that data governance and supervision remain central even as AI systems take on more operational tasks. Banks and insurers have been looking at where AI can reduce manual work in reconciliation, investigations and document processing.

Oversight gap

The CybSafe finding suggests that oversight challenges begin well before multi-agent systems or complex orchestration. They arise when employees decide what information to enter into AI tools during everyday work.

That has implications for firms handling customer records, market-sensitive material and commercially confidential data. It also raises questions about whether training and controls are being tested against actual behaviour rather than policy checklists.

"The real test won't be how many AI agents a firm deploys, but how much manual work they take away and whether they're freeing people to focus on the decisions that actually matter," Maxfield said.