For two decades, the pitch for data loss prevention was simple. Classify the sensitive data, watch the exits, and stop it from leaving. Most large enterprises bought the technology long ago, and for many CIOs it sits on the compliance checklist as a solved problem. A new survey suggests that confidence is misplaced.
The Cloud Security Alliance’s DLP in the AI Era report, produced with Jazz and based on 433 IT and security professionals surveyed in June and July 2026, found that 73% of organisations had at least one confirmed data loss incident in the past 24 months. Only 16% said their DLP stopped their most significant incident before the data left. In most shops, the tool documented the loss after the fact. The CSA’s Hillary Baron put it bluntly: the question is no longer whether to deploy DLP but whether it is doing what it was bought to do.
A visibility problem that GenAI makes worse
The sharpest finding concerns generative AI. Close to half of respondents (48%) named GenAI as their top exfiltration risk, yet fewer than three in ten (29%) could produce a routine 30-day report on sensitive data sent to GenAI tools. Security teams know where the danger is, but they cannot measure it.
Other research points the same way. A Neon Cyber survey of U.S. security leaders, published in August, found that 92.9% acknowledged at least one blind spot in their AI observability. It also found that workers reported sharing sensitive or regulated data at a rate of 20.3%, against a security-team estimate of 14.2%. Neon sells browser security, so read the numbers with that in mind. They still match the CSA’s picture of teams who believe they have coverage and cannot show it.
The scale of the sprawl explains much of this. Jazz CEO Ido Livneh said that across the customer environments his company observes, the average organization uses nearly 170 AI tools, and fewer than 10 are sanctioned. Employee behavior compounds the problem. A PagerDuty survey, as compiled by a security education site, found that 66% of office professionals had used AI tools at work that they believed were not permitted. Other compilations suggest that only about a third of enterprise AI usage runs through approved accounts. Traffic on personal logins and free tiers is invisible to controls built around corporate identity and managed endpoints.
The financial stakes are rising too. Figures compiled from IBM’s 2026 Cost of a Data Breach research indicate that 43% of breached organisations experienced a shadow AI incident, up from 20% a year earlier, and that breaches involving shadow AI averaged $5.39 million.
The controls point at the wrong threats
The CSA data also shows a mismatch between risk and enforcement. GenAI (48%) and cloud storage uploads (41%) topped the list of exfiltration worries, but only 22% of organizations strictly block GenAI and 19% strictly block cloud uploads. Removable media ranked last as a risk, at 10%, yet it is the most strictly blocked channel, at 31%.
The explanation is probably historical rather than strategic. Blocking USB drives is easy, well understood and rarely disrupts anyone’s workflow. A policy built on that logic is guarding the door the business stopped using years ago while the windows stay open.
Why enforcement gets softened
The more uncomfortable finding is that security teams are retreating, and the business is the main reason. Seventy-one percent of respondents said they had received pushback on DLP enforcement in the past two years. Among those teams, two-thirds carved out exceptions for specific groups or use cases, 8% eased enforcement across the whole organization, and 3% reduced or paused the program entirely. Across all respondents, 54% had softened enforcement in some form.
That is a rational response to a real problem. Fifty-four percent of teams said most of the DLP alerts they triage turn out to be false positives, and 90% reported at least one measurable consequence of alert fatigue in the past year. Twenty-one percent said staff had voluntarily left because of the burden. A tool that interrupts salespeople with spurious blocks and drowns analysts in noise will lose the argument with the business, and then with the security team itself. What remains is a monitoring system that runs in a permissive mode.
The pressure is not limited to junior staff. A BlackFog study of 2,000 workers in the U.S. and UK, published in January, reported that 86% use AI tools at least weekly for work, and its headline warned that senior leaders in particular are bypassing safeguards under productivity pressure. When executives route around controls, exceptions become the policy.
Why this keeps happening
None of this is new in kind. The pattern has repeated across industries, and AI has multiplied the number of channels and the volume of data moving through them. Legacy DLP was designed around files, email attachments and network egress. It struggles with a developer pasting a stack trace into a chatbot, a browser extension quietly sending page content to a third-party model, or an AI agent with API access to a document store.
Mimecast’s State of Human Risk 2026 report adds to the picture. By its count, 80% of organisations worry about data leaking through generative AI, yet 60% have no specific strategy to address it. Concern is not the scarce resource. Capability is.
What CIOs should take from this
The CSA findings do not argue for abandoning DLP. They argue for judging it by outcomes rather than deployment. A CIO should be able to ask four questions and get evidence in return. How many incidents in the past year were stopped before data left, rather than detected afterward? Can the team produce a current inventory of AI tools in use, sanctioned or not? Which exceptions to enforcement exist, who approved them, and when do they expire? And what share of alerts reflects real risk?
The answers point toward fewer, better-tuned blocking rules on the channels that matter, with policy aligned to how data moves today rather than to how it moved in 2012. They also point toward offering sanctioned AI tools good enough that employees have less reason to go around them, and toward shared ownership of enforcement decisions with business leaders, so security is not negotiating every exception alone. Jazz’s Livneh described the goal as focusing on real risk without blocking legitimate work. That is easy to say and hard to execute, but the alternative is the one the survey describes: a program that records losses accurately and prevents very few of them.