AI-powered apps have gone beyond the initial demo phase, and they are now active in the majority of businesses, pulling customer records, ticket histories, internal documents and feeding them straight into a prompt. Every time this happens it is a chance for sensitive data to slip the net, unless something is actually looking at what’s inside it. And I strongly suspect that a lot of organizations haven’t started looking inside them yet.
LLMs don’t forget
Unless you are using an enterprise version of an AI model, with specific terms and conditions prohibiting it, once sensitive data enters a prompt, or is shared within a retrieved file, or if an API response is passed along for context, it becomes a permanent piece of the LLM’s memory banks. One analysis of 1.6 million workers found that about 11% of what employees paste into ChatGPT is confidential company data. A separate industry study found that 77% of employees who use generative AI have pasted data into prompts, and 82% of those pastes came from personal, unmanaged accounts. According to Netskope’s 2026 Cloud and Threat Report, source code accounts for 42% of all genAI data policy violations, the single largest category, followed by regulated data (32%) and intellectual property (16%).
Don’t stop the workflow, just redact the sensitivity
Data loss prevention tools (DLP) have long watched the ‘exits’ for data exfiltration (file shares, emails, and uploads). AI adds to the complexity of that challenge, and not simply as a singular new exfiltration route. The responses coming back from the models can now potentially carry sensitive data too. A filter or solution that looks at the outbound side only sees half the conversation.
That’s why, despite it being one of our most established products, we haven’t let Netskope One DLP gather dust on its capabilities. Our DLP treats any AI interaction as a boundary. It sits between your AI-powered applications or agents, and the models they call. It inspects every text prompt on the way out and every response on the way back. When a policy matches, data security teams can block the call or redact the specific sensitive entities. Each value is redacted while the call continues, and the model doesn’t see the original sensitive information. You set redaction per entity within your DLP profiles and apply them as a policy within the Netskope Skylight AI Gateway.
This sort of redaction has obvious benefits in that it avoids throttling productivity, but it only works if it understands context. For instance, a 16-digit number in a payment field is a credit card, so we mask it. A similar number in a math problem is not, and redacting it would be a false positive making users lose confidence in the solution.
Your teams are sending card numbers, patient records, and customer lists to AI models, and the safety filters built into those models weren’t designed to notice. More than that, they do not allow you to determine what your own organization considers sensitive (your CEO’s signature, a specific confidential project detail, etc). In real-world enterprise deployments, the most prevalent types of sensitive information we encounter are an organization’s intellectual property and their customer’s data. Native AI content moderation screens for hate speech and harmful content, but not sensitive data, and it sits on the provider’s side, out of view of the traffic inside their own perimeter.
The workflow explained:
Entity redaction happens in an AI gateway directly in the traffic path between your AI-powered applications or agents and the models they call. It can be self-hosted, in your own VPC, or behind a cloud provider’s API.
By sitting in the heart of the action, the gateway can see each request before it reaches the model (and becomes permanently imprinted on its memory). The redaction engine scans the request, finds the sensitive entities (names, card numbers, identifiers, health data), and masks them.
This provides two major benefits:
- Regulated data that never reaches the model can’t become a reportable exposure.
- With forensics enabled, Netskope One DLP masks the matched content for incident management and uploads it to a forensic destination you control. Investigators have the evidence they need, and everything stays in your own environment.
Why this matters more as agents take over the work
As enterprise environments have more and more agents running, the stakes are becoming ever higher. A chatbot connected to Slack, Teams, or Jira makes app-to-model calls and is often granted broad access in order to be able to provide useful answers. Requesting a summary of recent meetings can expose sensitive topics in the model’s response, such as layoff plans or unreleased products, unless it is masked first.
Regulators are also reinforcing the need for effective redaction, with GDPR fines exceeding €7.1 billion since 2018. European authorities receive roughly 443 breach notifications daily, a 22% year-over-year increase, and IBM’s 2026 Cost of a Data Breach Report sets a new record, with average breach costs reaching $4.99 million globally and $11.5 million in the United States, up 12% and 13% respectively from the prior year. The report also found that AI-driven attacks increased 56%, adding an average of $1 million to breach costs, underscoring the growing financial risk of inadequate AI security controls.
Entity redaction does the pre-model masking keeping personal data out of models, which simplifies GDPR compliance; Applying HIPAA de-identification standards enables safe clinical AI workflows; and PCI-DSS compliance scope is reduced when cardholder data is masked before reaching AI infrastructure. Effective entity redaction also maintains an audit trail of every intercepted and masked entity per call.
Where this leaves us
A private model with a native content filter is a reasonable start for data security in AI. However, that approach can’t tell you what sensitive data moved between your applications and the models they called, and therefore you cannot know that sensitive data hasn’t made it into the model’s knowledge banks, or back out in a response.
Entity redaction replaces sensitive values, such as names and account numbers, with stand-ins before data reaches an AI model. The model keeps the data structure it needs to work, and it never sees real identities. Redaction follows data risk, so applications keep working while security teams control what leaves the organization.
If you’re building AI-powered applications or agents that call an LLM, whether self-hosted or in the cloud, map which entities move through that traffic today. Reach out to our team, or book a POV to watch Netskope One DLP’s redaction capabilities catch a sensitive entity in your own environment.
