Using AI Tools Securely
What data should you keep away from AI tools? Defending against deepfakes, AI-driven phishing, and establishing verification safe words.
Why It Matters
AI chat tools have rapidly integrated into our daily workflows. While they offer substantial productivity gains, they introduce two critical risks: the data we share with them and synthetic content used against us.
The Fundamentals
- What you enter matters: Any text you type into an AI tool is sent to the vendor's servers. Depending on account settings, it may be retained and used to train future models. Never paste customer records, personal data, passwords, source code, contracts, or draft proposals into unapproved tools.
- Organizational policy: Companies must clearly define which tools are authorized and what data tiers they can process. Whenever possible, rely on enterprise tiers that explicitly exclude corporate data from model training.
- Inaccuracies and hallucinations: AI systems often state incorrect facts with absolute confidence. Always verify outputs independently, especially for legal, medical, and financial matters.
- Deepfakes: Convincing synthetic audio and video can now be generated from just a few seconds of sample footage. Fraud schemes where an attacker uses an executive's cloned voice to request an urgent wire transfer are an active, real-world threat.
- AI-powered phishing: Attackers can generate highly tailored, grammatically flawless, and deeply persuasive emails. The conventional advice that phishing emails always contain typos no longer holds true.
A Real-World Scenario
An accounting manager receives a phone call from someone who sounds identical to the CEO, demanding an "urgent payment." Following procedure, the manager asks for the team's pre-arranged safe word. The caller fails to provide it, and the fraudulent transfer is thwarted.
Action Items
- Before pasting anything into an AI prompt, ask yourself: "Would it be an issue if this appeared on the front page of a newspaper?"
- Anonymize personal and sensitive details before submission (e.g., replace actual names with "Client A").
- Agree on a confidential safe word with your family and key team members for urgent phone verifications.
- Always authenticate critical or unusual requests through an independent, secondary channel.
Key takeaway: Once you paste data into an AI tool, it is no longer yours alone.
*This is part 11 of the 14-part Cybersecurity Awareness series.* Next up: Security culture, policies, and procedures