59.2% of security leaders have confirmed at least one AI-related security incident in the past 12 months. 60% involved data leaking out — and by the time most of them were caught, the data was already gone.
Nearly six in ten organizations surveyed by Neon Cyber handled a confirmed AI-related security incident in the last 12 months — not a near-miss, not a suspected exposure, but an event that occurred, was investigated, and required a response.
What do AI-related security incidents look like?
Of the 100 respondents who confirmed at least one AI-related security incident:
(Respondents could select multiple categories, so these aren't mutually exclusive.)
Data leakage leading the list tracks with the visibility shortfall covered elsewhere in Neon Cyber research: the activity security teams are least equipped to see — content moving through prompts and pastes — is also what shows up most once an incident is confirmed.
How were these incidents detected?
Across the 100 confirmed incidents:
- EDR / XDR / SIEM alerts: 44%
- Security logs and telemetry review: 35%
- Browser security tool alerts: 35%
- Third-party alerts: 19%
- User reports: 18%
This means that AI-related security incidents were mostly found after an event had already happened. A security analyst opened an EDR alert on Monday morning, but the data leaked happened Friday afternoon via copy and paste.
Nearly detection path above is reactive, except user reports. Even then, the employee at the center of the incident stayed silent 82% of the time — more likely because most organizations have no clear expectation that pasting something into an AI tool is the kind of action that gets reported, and no prompt in the moment that would have made the risk visible before they completed it, than because of any deliberate concealment.
What is reactive detection, and why does it matter for managing shadow AI?
Reactive detection means identifying a security incident through evidence left behind after an action has already completed — an alert, a log entry, a downstream anomaly — rather than through a control positioned to observe or intervene in the action itself. It's the default detection model for most AI-related incidents today: the tools generating 79% of these detections (EDR/XDR/SIEM alerts plus log and telemetry review) were built to monitor endpoints and network traffic, not the content of a browser session in real time.
That default puts a ceiling on what "managing shadow AI" can actually mean. Governance tools — approval processes, acceptable-use policies, training — are built to shape behavior before it becomes a problem. But if the only feedback a security team gets is an alert generated after the data has already left, none of those tools have anywhere to intervene.
More employee training could be useful, but it is often a governance tool, not a detection one. An employee told not to upload sensitive data into an AI tool may still copy and paste it under deadline pressure since they’re not technically uploading a file.
The takeaway: A detection model built entirely on evidence left behind after the fact keeps security one step behind, cataloging shadow AI incidents rather than getting ahead of them. What security teams need is a capability that acts before that point, at the click, ahead of the alert.
What would catching these incidents earlier require?
A control positioned inside the browser session itself, evaluating content and intent at the moment an action is taken — the point of click — rather than downstream, once the action has already generated a log entry somewhere else. Disabling or intervening on copy-and-paste into a prompt or form field is the kind of intervention that would move detection from the 82%-after-the-fact side of this data to something closer to prevention.
Where Neon Cyber fits
Point-of-intent detection sits alongside EDR, XDR, and SIEM, closing the specific window those tools were never positioned to see into: the browser session itself, in real time, ahead of when the telemetry would otherwise catch up.
For the 60% of confirmed incidents in this data that involved data leakage, that's what separates the Monday-morning alert from a control that would have caught the Friday-afternoon paste as it happened.
FAQs
If we already have EDR and SIEM, do we still need something at the point of click?
Yes, for the specific window between the action and the alert. EDR/XDR/SIEM alerts accounted for 44% of how confirmed incidents were detected in Neon Cyber's research — real detection, but detection that happens after the data has already left. Point-of-click controls close that interval; they don't replace the downstream tooling.
Does disabling copy-paste into AI tools break legitimate workflows?
It depends on how narrowly the control is scoped. A blanket copy-paste block would interfere with routine, low-risk use. Content- and context-aware enforcement — evaluating what's being pasted and where, rather than blocking the action category outright — is what allows the intervention to target the 60% of incidents involving data leakage without shutting down AI use altogether.
How do we build the case internally that our current detection is too slow?
Pull your last several confirmed incidents and check the detection path against the timeline: how long between the action and the alert. 82% of confirmed AI-related incidents were never reported by the employee involved, which means that interval is almost always sitting somewhere in your own logs, waiting to be measured.