As inscrições já estão abertas para a SASE Week 2023! Entre na lista de convidados.

A plataforma do futuro é a Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) e Private Access for ZTNA integrados nativamente em uma única solução para ajudar todas as empresas em sua jornada para o Secure Access Service Arquitetura de borda (SASE).

Vá para a plataforma
Vídeo da Netskope
Borderless SD-WAN: Desbravando na Nova Era da Empresa Sem Fronteiras

Netskope Borderless SD-WAN oferece uma arquitetura que converge princípios de confiança zero e desempenho de aplicativo garantido para fornecer conectividade segura e de alto desempenho sem precedentes para cada site, nuvem, usuário remoto e dispositivo IoT.

Leia o artigo
Borderless SD-WAN
Adote uma arquitetura Secure Access Service Edge (SASE)

O Netskope NewEdge é a maior nuvem privada de segurança de alto desempenho do mundo e oferece aos clientes cobertura de serviço, desempenho e resiliência inigualáveis.

Conheça a NewEdge
NewEdge
Sua Rede do Amanhã

Planeje seu caminho rumo a uma rede mais rápida, segura e resiliente projetada para os aplicativos e usuários aos quais você oferece suporte.

Receba o whitepaper
Sua Rede do Amanhã
Netskope Cloud Exchange

O Cloud Exchange (CE) da Netskope oferece aos clientes ferramentas de integração poderosas para tirar proveito dos investimentos em estratégias de segurança.

Saiba mais sobre o Cloud Exchange
Vídeo da Netskope
Mude para serviços de segurança na nuvem líderes de mercado com latência mínima e alta confiabilidade.

Conheça a NewEdge
Lighted highway through mountainside switchbacks
Permita com segurança o uso de aplicativos generativos de IA com controle de acesso a aplicativos, treinamento de usuários em tempo real e a melhor proteção de dados da categoria.

Saiba como protegemos o uso de IA generativa
Ative com segurança o ChatGPT e a IA generativa
Soluções de zero trust para a implementação de SSE e SASE

Conheça o Zero Trust
Boat driving through open sea
A Netskope permite uma jornada segura, inteligente e rápida para a adoção de serviços em nuvem, aplicações e infraestrutura de nuvem pública.

Conheça as Soluções para o Setor
Wind turbines along cliffside
  • Recursos

    Saiba mais sobre como a Netskope pode ajudá-lo a proteger sua jornada para a nuvem.

  • Blog

    Saiba como a Netskope viabiliza a segurança e a transformação de redes através do security service edge (SSE).

  • Eventos e workshops

    Esteja atualizado sobre as últimas tendências de segurança e conecte-se com seus pares.

  • Security Defined

    Tudo o que você precisa saber em nossa enciclopédia de segurança cibernética.

Podcast Security Visionaries

Leveling Up the SASE Conversation
Robert Arandjelovic and Gerry Plaza sit down to chat with Max Havey about how embracing a SASE journey can help bring networking and security teams closer together.

Reproduzir o podcast
Leveling Up the SASE Conversation
Últimos blogs

Como a Netskope pode habilitar a jornada Zero Trust e SASE por meio dos recursos de borda de serviço de segurança (SSE).

Leia o Blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Junte-se a nós na quarta SASE Week anual, de 26 a 28 de setembro.

Registrar
SASE Week 2023
O que é o Security Service Edge?

Explore o lado de segurança de SASE, o futuro da rede e proteção na nuvem.

Saiba mais sobre o Security Service Edge
Four-way roundabout
  • Nossos clientes

    Netskope atende a mais de 2.000 clientes em todo o mundo, incluindo mais de 25 dos 100 da Fortune.

  • Customer Solutions

    Estamos aqui junto com você a cada passo da sua trajetória, assegurando seu sucesso com a Netskope.

  • Netskope Community

    Aprenda com outros profissionais de rede, dados e segurança.

  • Treinamento e certificação

    Os treinamentos da Netskope vão ajudar você a ser um especialista em segurança na nuvem.

Ajudamos nossos clientes a estarem prontos para tudo

Ver nossos clientes
Woman smiling with glasses looking out window
A talentosa e experiente equipe de Serviços Profissionais da Netskope fornece uma abordagem prescritiva para sua implementação bem sucedida.

Conheça os Serviços Profissionais
Netskope Professional Services
A Comunidade Netskope pode ajudar você e sua equipe a obter mais valor de produtos e práticas.

Acesse a Comunidade Netskope
A Comunidade Netskope
Proteja sua jornada de transformação digital e aproveite ao máximo seus aplicativos de nuvem, web e privados com o treinamento da Netskope.

Saiba mais sobre Treinamentos e Certificações
Group of young professionals working
  • Empresa

    Ajudamos você a antecipar os desafios da nuvem, dos dados e da segurança da rede.

  • Por que Netskope

    A transformação da nuvem e o trabalho em qualquer lugar mudaram a forma como a segurança precisa funcionar.

  • Liderança

    Nossa equipe de liderança está fortemente comprometida em fazer tudo o que for preciso para tornar nossos clientes bem-sucedidos.

  • Parceiros

    Fazemos parceria com líderes de segurança para ajudá-lo a proteger sua jornada para a nuvem.

Apoiando a sustentabilidade por meio da segurança de dados

A Netskope tem o orgulho de participar da Visão 2045: uma iniciativa destinada a aumentar a conscientização sobre o papel da indústria privada na sustentabilidade.

Saiba mais
Apoiando a sustentabilidade por meio da segurança de dados
O mais alto nível de Execução. A Visão mais avançada.

A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.

Obtenha o Relatório
A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.
Pensadores, construtores, sonhadores, inovadores. Juntos, fornecemos soluções de segurança na nuvem de última geração para ajudar nossos clientes a proteger seus dados e seu pessoal.

Conheça nossa equipe
Group of hikers scaling a snowy mountain
A estratégia de comercialização da Netskope, focada em Parcerias, permite que nossos Parceiros maximizem seu crescimento e lucratividade enquanto transformam a segurança corporativa.

Saiba mais sobre os parceiros da Netskope
Group of diverse young professionals smiling

Cloud and Threat Report: AI Apps in the Enterprise

azul claro mais
This report examines how organizations are balancing the benefits of AI tools while also managing the associated risks, highlighting an increasingly popular strategy that involves DLP and interactive user coaching.
Dark cloud over the sunset
9 min read

Destaques do Relatório

resposta de teste
  • AI app use in the enterprise is increasing exponentially, up 22.5% over the past two months.
  • ChatGPT is the most popular AI app in the enterprise and Google Bard is the fastest growing AI app in the enterprise, both by a large margin.
  • Source code is posted to ChatGPT more than any other type of sensitive data, at a rate of 158 incidents per 10,000 enterprise users per month.
  • Attackers are creating AI app scams and phishing sites to try to capitalize on the hype surrounding ChatGPT.
  • DLP and user coaching are the most popular types of controls enterprises use to enable AI app use while preventing sensitive data exposure.

Executive Summary

sdofjsfojefgejelosij

The conversation around AI often centers on existential questions, such as the potential opportunities and threats AI may bring to humanity. Yet, organizations worldwide and their leaders are dealing with a more immediate concern: How can they use AI apps safely and securely?

Organizations strive to leverage AI applications to enhance operations, improve customer experiences, and facilitate data-driven decision-making. The key is to do this while ensuring safety and security. However, the main security hurdle lies in how some users might employ these applications.

Take ChatGPT, for example, which can be used to review source code for security flaws or assist in editing written content. ChatGPT was used to edit this very executive summary. Inevitably, some individuals will upload proprietary source code or text containing regulated data or intellectual property. The challenge lies in deterring such behavior without hindering the wider organization’s productivity. An outright block on AI applications could solve this problem, but would do so at the expense of the potential benefits AI apps offer.

As we continue to be surrounded by the hype centered on the possibilities of AI, it is evident that ChatGPT and other AI apps are on their way to becoming mainstays in the enterprise. Among Netskope customers, their popularity is growing exponentially, expected to double within the next seven months if they continue to grow at the current rate. This report delves into the rising prominence of AI applications in enterprises, outlines associated risks, including data leaks and potential attacker activity, and proposes strategies for safely and securely integrating ChatGPT and other AI tools in the enterprise setting.

AI Apps Growing in Popularity

The number of users accessing AI apps in the enterprise is growing exponentially. Over the past two months, the percentage of enterprise users accessing at least one AI app each day has increased by 2.4% weekly, for a total increase of 22.5% over that time period. At the current growth rate, the number of users accessing AI apps will double within the next seven months. Over the same time period, the number of AI apps in use in the enterprise held steady, with organizations with more than 1,000 users averaging 3 different AI apps per day, and organizations with more than 10,000 users averaging 5 AI apps per day. At the end of June, 1 out of 100 enterprise users interacted with an AI app each day.

AI app popularity based on number of enterprise users

The most popular enterprise AI app by a large margin is ChatGPT, with more than 8x as many daily active users as any other AI app. ChatGPT has been the center of much hype for the past six months and is also very versatile, likely contributing to its popularity. The next most popular app is Grammarly, which focuses exclusively on writing assistance. Bard, Google’s chatbot, comes in just below Grammarly. All other AI apps combined (of which we are tracking more than 60, including Jasper, Chatbase, and Copy.ai) are less popular than Google Bard.

Most popular AI apps by percentage of total daily AI users

Over the past two months, the fastest growing AI app in the enterprise was Google Bard. Although it still lags far behind ChatGPT in popularity, Google Bard is currently adding users at a rate of 7.1% per week, compared to 1.6% for ChatGPT. At their current rates, Google Bard is poised to catch up to ChatGPT in just over a year. However, as the AI app space is very dynamic, we expect to see many more changes during that time which will disrupt the current growth rates.

Netskope Threat Labs tracks the popularity of AI apps in enterprise environments, rather than the overall popularity of the apps among consumers. For example, while ChatGPT popularity skyrocketed among consumers before cooling off in June, its adoption in the enterprise has been more measured and continues to increase exponentially. The remainder of this report highlights some of the reasons for the measured increase, which include risks of data leakage and controls around its use.

Fastest growing AI apps by number of active daily users added weekly

AI Risks - Sensitive Data

This segment focuses on ChatGPT, the leading AI app in the enterprise by a large margin. An average ChatGPT user interacts with the app by posting 6 prompts daily. The activity level varies by user, with the top 10% of users posting 22 prompts and the top 1% posting 68 prompts daily. For every 10,000 users, an organization can expect around 660 daily prompts to ChatGPT. But the real question lies in the content of these prompts: Are they harmless queries, or do they inadvertently reveal sensitive data?

A Netskope study revealed that source code was the most frequently exposed type of sensitive data, with 22 out of 10,000 enterprise users posting source code to ChatGPT per month. In total, those 22 users are responsible for an average of 158 posts containing source code per month. This trend is not entirely unexpected, considering ChatGPT’s ability to review and explain code and pinpoint bugs and security vulnerabilities. While these services are beneficial, sharing confidential source code with ChatGPT introduces risks including potential data breaches, accidental data disclosure, and legal and regulatory risks.

Users posting sensitive data per 10,000k enterprise users per month

Compared to source code, posts containing other forms of sensitive data are relatively less common. For every 10,000 enterprise users, there are typically 18 incidents of sharing of regulated data (encompassing financial data, healthcare information, and personally identifiable information) on a monthly basis. Intellectual property (excluding source code) is rarer still, with an average of 4 incidents per month for every 10,000 users. Interestingly, passwords and keys also appear among the sensitive data types shared, usually embedded in source code. Despite its relative infrequency (about 4 incidents per 10,000 users monthly), this practice serves as a crucial reminder to software engineers about the risks of hard-coding secrets into source code.

Incidents of users posting sensitive data per 10,000k enterprise users per month

Opportunistic Attackers

With all the hype surrounding ChatGPT and AI apps in general, it is unsurprising that scammers, cybercriminals, and other attackers would attempt to exploit the hype for illicit gains. This is common practice with attackers. For example, the Netskope Threat Labs Cloud and Threat Report from Spring 2023 highlighted attackers attempting to capitalize on the Russo-Ukrainian war, the earthquake in Turkey and Syria, and the collapse of Silicon Valley Bank. The hype and popularity of ChatGPT draws the attention of attackers and scammers because of the large target pool and potential for profit, combined with the varied proficiency of users on the platform.

Throughout the first half of 2023, Netskope Threat Labs has tracked multiple phishing campaigns, malware distribution campaigns, and spam and fraud websites seeking to capitalize on the ChatGPT hype. Netskope Threat Labs is even tracking multiple ChatGPT proxies, sites that appear to offer the benefit of free, unauthenticated access to the chatbot, but at the cost of revealing all your prompts and responses to the proxy operator.

A ChatGPT proxy where the proxy operator sees all prompts and responses

A ChatGPT proxy where the proxy operator sees all prompts and responses

 
In total, Netskope Threat Labs is currently tracking more than 1,000 malicious URLs and domains seeking to capitalize on the ChatGPT and AI hype. The number alone is a reminder of the importance of using a multi-layered approach to protect users from attackers attempting to capitalize on the hype and popularity surrounding any significant event or trend. Such an approach should include domain filtering, URL filtering, and content inspection to protect against both known and unknown attacks.

Enterprise Controls

While a common practice when ChatGPT was first gaining popularity was for enterprises to block the chatbot altogether, organizations have since come to terms with the fact that ChatGPT and other AI apps can offer advantages to the organization, including enhancing operations, improving customer experiences, and facilitating data-driven decision-making. Instead of blocking ChatGPT, organizations have transitioned to a more permissive model that typically includes a combination of DLP and user coaching. DLP can be used to identify potentially sensitive data being posted to AI apps, including ChatGPT, and user coaching can leave the ultimate decision of whether or not to proceed with a prompt to the user.

Organizations placing controls around ChatGPT

The specific controls around ChatGPT vary by industry vertical. Overall, financial services, healthcare, and technology companies have led the charge in implementing controls around ChatGPT. However, the approach each industry has taken varies significantly. In financial services and healthcare, both highly regulated industries, nearly 1 in 5 organizations have implemented a blanket ban. No users are allowed to use ChatGPT. In the technology vertical, only 1 in 20 organizations have implemented a blanket ban. Instead 1 in 4 organizations are using DLP controls to detect specific types of sensitive information (especially source code) being posted to ChatGPT. Furthermore, 1 in 5 technology organizations implement real-time user coaching to remind users of company policy and the risks that come along with ChatGPT and other AI apps. Ultimately, more organizations are likely to adopt DLP controls and real-time user coaching over time to enable the use of AI apps like ChatGPT while safeguarding against unwanted data exposure.

Type of ChatGPT controls by industry vertical

Recomendações

Safely enabling the adoption of AI apps in the enterprise is a multifaceted challenge. It involves identifying permissible apps and implementing controls that empower users to use them to their fullest potential while safeguarding the organization from risks. This section includes general technical recommendations for organizations aiming to safely enable AI apps. For more detailed information about how Netskope can help, please refer to the ChatGPT and Generative AI Data Protection solution brief.

→ Regularly review AI app activity, trends, behaviors, and data sensitivity, to identify risks to the organization.

→ Block access to apps that do not serve any legitimate business purpose or that pose a disproportionate risk. A good starting point is a policy to allow reputable apps currently in use while blocking all others.

→ Use DLP policies to detect posts containing potentially sensitive information, including source code, regulated data, passwords and keys, and intellectual property.

→ Employ real-time user coaching (combined with DLP) to remind users of company policy surrounding the use of AI apps at the time of interaction.

Block opportunistic attackers attempting to take advantage of the growing popularity of AI apps by blocking known malicious domains and URLs, and inspecting all HTTP and HTTPS content.

→ Use Remote Browser Isolation (RBI) technology to provide additional protection when there is a need to visit websites in categories that can present higher risk, like newly observed and newly registered domains.

→ Ensure that all security defenses share intelligence and work together to streamline security operations. Netskope customers can use Cloud Exchange to share IOCs, import threat intel, export event logs, automate workflows, and exchange risk scores.

Sobre este relatório

Netskope Threat Labs publishes a quarterly Cloud and Threat Report to highlight a specific set of cybersecurity challenges. The purpose of this report is to provide visibility into cybersecurity risks that AI apps present and how organizations are managing those risks. The analysis presented in this report is based on a study of millions of users from thousands of organizations worldwide, for the period starting May 1, 2023 through June 30, 2023. Stats are reflection of attacker tactics, user behavior, and organization policy. Information presented in this report is based on anonymized usage data collected by the Netskope Security Cloud platform relating to a subset of Netskope customers with prior authorization.

Netskope Threat Labs

Staffed by the industry’s foremost cloud threat and malware researchers, Netskope Threat Labs discovers, analyzes, and designs defenses against the latest web, cloud, and data threats affecting enterprises. Our researchers are regular presenters and volunteers at top security conferences, including DEF CON, Black Hat, and RSA.

azul claro mais

Relatórios de nuvem e ameaças

O Netskope Cloud and Threat Report traz informações exclusivas sobre a adoção de aplicativos na nuvem, mudanças no panorama das ameaças preparadas para a nuvem e os riscos para os dados corporativos.

Storm with lightning over the city at night

Acelere seu programa de segurança com o líder em SASE.