ChatGPT Enterprise Security: Risks, Incidents, and Protection Strategies

The Samsung Wake-Up Call

In April 2023, Samsung became the cautionary tale every CISO references. Just three weeks after lifting its ChatGPT ban, Samsung employees had leaked confidential data to ChatGPT on at least three separate occasions.

The Three Incidents

Incident 1: Source Code Leak An engineer copied source code from a faulty semiconductor database into ChatGPT and asked it to help find a fix. OpenAI said it may use data submitted to consumer ChatGPT to improve its models, and Samsung noted that data sent to external servers is difficult to retrieve and delete.

Incident 2: Additional Code Sharing Another employee shared confidential code while trying to find a fix for defective equipment.

Incident 3: Meeting Notes A third employee submitted an entire internal meeting to ChatGPT and asked it to create the minutes.

The Aftermath

Samsung's response evolved rapidly:

1. Initial: an emergency limit of 1024 bytes per employee prompt to ChatGPT
2. Then: a temporary restriction on generative AI tools on company devices and internal networks, effective 1 May 2023
3. Long-term: development of in-house AI tools

The Internal Survey

In an internal survey in April 2023, Samsung asked staff about generative AI:

• About 65% of participants said using generative AI tools carries a security risk
• Yet the leaks had already happened, during ordinary work tasks

This gap between perceived risk and everyday use is the core Shadow AI challenge.

The Broader Problem: By the Numbers

Samsung isn't unique. Separate studies measure the same pattern:

Cyberhaven also found that, on average, employees input sensitive data into AI tools once every three days.

Understanding the Risk Tiers

Tier 1: Free ChatGPT (Highest Risk)

Risk Level: Critical for any sensitive data

Tier 2: ChatGPT Plus (High Risk)

Risk Level: High - individual accounts, no oversight

Tier 3: ChatGPT Business, formerly Team (Medium Risk)

Risk Level: Medium - better controls, still gaps

Tier 4: ChatGPT Enterprise (Managed Risk)

Risk Level: Manageable with proper governance

The Enterprise vs. Free Paradox

Here's the challenge: even if your organization deploys ChatGPT Enterprise, employees can still access free ChatGPT through:

• Personal accounts on work devices
• Work devices on personal networks
• Personal devices on work networks
• Mobile phones

Enterprise deployment doesn't eliminate Shadow AI—it just provides a controlled alternative.

Technical Controls That Work

1. Network-Level Controls

What: Block or monitor AI domains at the network level How: Proxy, firewall, or CASB rules

# Example: AI domain blocking list
api.openai.com
chat.openai.com
claude.ai
gemini.google.com
perplexity.ai

Limitation: Employees can use mobile networks or VPNs

2. DLP for AI Traffic

What: Inspect traffic to AI services for sensitive data How: DLP policies targeting AI domains

Effective For:

• Detecting specific data patterns (credit cards, SSNs)
• Blocking known confidential keywords
• Alerting on high-volume paste operations

Limitation: Can't understand context or intent

3. Browser Isolation

What: Run AI tools in isolated browser environments How: Remote browser isolation (RBI) solutions

Effective For:

• Preventing copy-paste of sensitive data
• Blocking downloads from AI tools
• Audit logging all AI interactions

Limitation: Impacts user experience significantly

4. Endpoint Controls

What: Monitor and control AI tool usage on endpoints How: EDR/XDR with AI-specific rules

Effective For:

• Detecting AI application installations
• Monitoring clipboard for AI-bound data
• Enforcing AI policies on managed devices

Limitation: No control over unmanaged devices

Policy Controls That Work

Acceptable Use Policy

Define clear boundaries:

APPROVED AI TOOLS:
- ChatGPT Enterprise (for non-sensitive tasks)
- Internal AI Assistant (for all tasks)

PROHIBITED:
- Free ChatGPT, Claude, Gemini (personal accounts)
- Any AI tool not on approved list

NEVER INPUT:
- Source code
- Customer data
- Financial information
- Strategic documents
- Meeting recordings

Training Requirements

Incident Response

Prepare for AI-related incidents:

1. Detection: How will you know data leaked to AI?
2. Containment: Can you revoke AI access quickly?
3. Assessment: How do you evaluate exposure?
4. Notification: Who needs to know (regulators, customers)?
5. Remediation: What changes prevent recurrence?

The EU AI Act Dimension

The EU AI Act applies in phases. On the official timeline, as amended by the Digital Omnibus on AI:

AI Literacy (since February 2025)

Organizations must ensure that staff using AI systems have a sufficient level of AI literacy.

Transparency (since August 2026)

Article 50 transparency rules apply: people must be informed when they are interacting with an AI system.

High-Risk Documentation (from December 2027)

Rules for high-risk AI systems listed in Annex III, including technical documentation, apply from 2 December 2027.

ChatGPT used for a high-risk purpose, such as hiring decisions, may fall under the high-risk regime, requiring:

• Risk assessments
• Human oversight provisions
• Accuracy and robustness guarantees
• Audit trails

Building Your Protection Strategy

Step 1: Visibility

Before you can protect, you need to see. Identify:

• Which AI tools employees use
• What data goes to those tools
• How frequently
• Who (by department/role)

Step 2: Alternatives

Blocking without alternatives drives workarounds. Provide:

• Approved AI tools (ChatGPT Enterprise, etc.)
• Clear use cases for each tool
• Fast approval process for new tools

Step 3: Controls

Layer your defenses:

• Network: Monitor/block AI domains
• Endpoint: Detect AI applications
• Data: DLP for AI traffic
• Identity: SSO for approved tools

Step 4: Training

Technology alone isn't enough:

• Regular AI security awareness
• Role-specific guidance
• Incident examples (like Samsung)
• Clear escalation paths

Step 5: Governance

Ongoing management:

• Regular policy reviews
• New tool evaluations
• Incident tracking
• Compliance monitoring

Start With Assessment

You can't secure what you don't understand. Our Shadow AI Audit gives you:

• A governance score with a letter grade from A to F
• The gaps behind that score, dimension by dimension
• The risks your answers reveal, ranked by severity
• Prioritized recommended actions, and a 90-day roadmap on request

5 minutes. Free. Anonymous results.

Samsung's lesson can be your prevention—if you act before the incident.