shadow AI
Mapping the Data Risk in Shadow AI Usage Across Your Org
Employees are not reckless. They are fast. A framework for identifying which teams carry the highest prompt-data risk before an incident proves it for you.
RESEARCH + INSIGHTS
Practical writing on AI tool risk and enterprise security.
From the Unbound Security research team. No vendor spin. Just what we observe and what security teams can do about it.
Featured article
Copilotsource code
GitHub Copilot and Source Code Leakage: What Security Teams Miss
Copilot completes code by sending context to the model. That context often contains more than the developer intends. A closer look at what gets transmitted.
policyAUP
Building an AI Acceptable Use Policy That Employees Actually Follow
A policy nobody reads is not a policy. Practical structure for an AI AUP that maps to how employees actually work rather than how security teams wish they did.
PIIML
PII Detection in Generative AI Prompts: Precision vs Recall Tradeoffs
High recall catches everything but drowns security teams in alerts. High precision misses edge cases. How Unbound calibrates the tradeoff across data types.
governanceAI tools
How Security Teams Are Governing AI Tool Usage in 2026
Conversations with security engineers at growing companies reveal three distinct governance postures. None of them are "block all AI tools."
customer dataPII
Customer Data in AI Prompts: Quantifying the Risk You Cannot See
Support agents paste ticket context into Claude. Sales reps paste CRM records into ChatGPT. The volume of customer data in AI prompts is higher than most companies suspect.
audit logsSIEM
AI Tool Audit Logs: What Security Teams Need and What They Get
Most AI tools offer logging in their enterprise tiers. The logs are rarely structured for security workflows. A breakdown of what is and is not exportable today.
exfiltrationGenAI
New Data Exfiltration Vectors in the GenAI Era
Traditional DLP modeled network egress. AI prompts are a new exfiltration surface that bypasses email, USB, and screen-capture controls entirely.
architectureinline DLP
Inline DLP versus API Scanning for AI Prompts: A Security Tradeoff
Post-hoc API scanning finds violations after data has already left. Inline inspection stops it in transit. The latency cost is real; here is how to evaluate it.
productivityguardrails
Securing Employee AI Usage Without Blocking It
A blanket ban on AI tools does not prevent data exposure. It pushes employees to personal devices outside corporate visibility. The alternative is a guardrail, not a gate.
legacy DLParchitecture
Why Legacy DLP Tools Miss AI Prompts Entirely
Legacy DLP inspects file transfers, email attachments, and clipboard events. It was not designed for HTTP POST bodies carrying freeform natural language. A gap analysis.