According to Softline, 85% of information security directors in Kazakhstan identify the safe internal use of artificial intelligence as their primary concern. This issue is equally relevant for Russian businesses, where employees often utilize public AI tools before companies can implement necessary technical restrictions or internal policies.
Furthermore, 76% of Kazakh security executives anticipate that cybercriminals will adopt more sophisticated attack methods between 2025 and 2028. Management is currently more focused on mitigating risks associated with employee interaction with AI than on protecting the AI models themselves from external threats.
The primary risk involves 'shadow AI,' where employees use unauthorized public services to process corporate documents, personal data, or trade secrets. Companies often lack visibility into which AI systems are being used and whether the data entered is being stored by third-party providers.
To address these vulnerabilities, experts recommend creating a registry of approved AI models, logging all queries and responses, and configuring Data Loss Prevention (DLP) systems to detect the transmission of sensitive information. For highly confidential tasks, organizations are advised to utilize private, closed-source models.
Viktor Gulevich from Softline emphasizes that a total ban on public AI tools is ineffective. Instead, companies should establish clear data handling policies and implement technical monitoring. Organizations can align their internal frameworks with standards such as ISO/IEC 42001, the NIST AI RMF, and the OWASP Top 10 for LLM Apps.
