4 ways to follow AI security best practices at work

• Use approved AI tools: Protect sensitive company and customer information by following your organization’s AI usage policies.
• Review AI-generated content: Check outputs for accuracy, security risks and suspicious links before sharing or acting on them.
• Keep humans in control: Understand what AI agents are authorized to do and when human oversight is necessary.

AI is rapidly changing the way we work, and cybersecurity teams are racing to keep businesses and their information safe. What began with employees using AI chatbots to draft emails and develop presentations has expanded into business applications, software development and now autonomous AI agents that can execute entire workflows with little to no human intervention.

These advancements are expected to bring significant benefits and change how business operates to many companies—and greater risk. According to Verizon’s most recent Data Breach Investigation Report, nearly a third of all safety breaches begin with vulnerability exploitation in an AI world. And because more employees now use ‘shadow AI’ (unapproved AI tools), increased company secrets are at risk: Shadow AI is now the third most common non-malicious data leakage related activity.

In my work leading Data, AI and Quantum Safe Security Services at a global technology company, I emphasize that AI is just like any other technology from a security context. Of course it’s unique in the sense that it can operate autonomously. However, it doesn’t automatically understand what’s confidential or where its responsibilities should end. Organizations must establish safeguards, but employees also have a role in enforcing them.

No matter your industry or role, here are four best practices to use AI tools more securely at work.

One of the most common mistakes I see is employees sharing sensitive company or customer information with unapproved AI tools. Someone might upload a confidential financial report for a quick summary or paste customer information into a chatbot to draft an email, without realizing the potential exposure.

An unapproved tool could be a free AI program you find online or even a personal account that you regularly use outside of work. Just because you’re familiar with a tool doesn’t mean it’s authorized to handle company information.

The first rule is simple: Only use AI tools approved by your organization. Many companies provide enterprise AI applications with safeguards designed to protect their data. Public AI tools may not offer the same protection for your data.

Before entering information into AI, check your company’s usage policies and consider whether you’re sharing confidential business information, customer records or personally identifiable information. Even approved tools may have restrictions on what data you can share. When in doubt, ask your IT team.

Protecting what you share with AI is only half the equation. You also need to verify what it produces.

Employees can ask AI to generate a report but it can also produce factual errors or fabricated information. You should always review the output before sharing content with a client or colleague.

Your judgment and expertise is what makes your contribution valuable. Use AI to support your thinking, not replace it. Verify important information, question its conclusions and add your own perspective before sharing the results.

Reviewing AI-generated material is also important for managing security risks. AI-generated links, documents and code shouldn’t automatically be trusted. Attackers may also embed malicious instructions in content an AI system processes, a technique known as prompt injection, to manipulate its behavior.

Be cautious with unfamiliar links and suspicious files, and never assume something is safe simply because AI generated or recommended it.

Unlike traditional chatbots, agentic AI can carry out entire tasks with limited human intervention. An AI agent might manage emails, process invoices or execute business workflows. But giving AI greater autonomy also introduces new security risks.

Consider an agent responsible for approving invoices. If an invoice doesn’t meet the approval criteria, the agent should stop or flag the exception. Without appropriate guardrails, however, it might keep trying different ways to complete its assigned task—even when approval isn’t authorized.

Agents can also be vulnerable to attackers who attempt to manipulate their actions, access confidential information or interfere with business processes. Organizations must establish technical safeguards that define what agents can do, restrict their access and provide ways to stop them when something goes wrong.

• What tasks and decisions are they authorized to perform?
• When is human approval required?
• How do you report or stop unexpected behavior?

While IT and security teams are responsible for implementing technical protections, employees play an important role in recognizing when an agent operates outside its intended boundaries.

Even with safeguards, security incidents can happen. Most organizations have incident response policies for traditional cybersecurity threats, but those procedures may not yet fully address AI-related incidents. That’s why I encourage employees to familiarize themselves with their company’s AI policies and incident reporting procedures.

If you accidentally share sensitive information with an unapproved AI tool or notice an AI agent accessing information or performing actions it shouldn’t, report it promptly to your IT or security team. Don’t attempt to investigate the incident yourself.

AI security is evolving quickly, particularly as organizations adopt autonomous AI agents and more sophisticated AI models. Frontier AI, for example, is becoming increasingly capable of discovering software vulnerabilities at unprecedented speed and scale. This creates opportunities for security teams to strengthen defenses—but also raises the possibility of cybercriminals exploiting those same capabilities. 

Organizations are continuing to develop policies and processes to manage these emerging risks. For employees, the takeaway is simple: With the right safeguards in place, AI can be a powerful tool for working more efficiently and creatively. The ore you understand how to use these tools safely and effectively, the more confidently you can take advantage of their capabilities at your job.

Ready to build your AI skills? Verizon AI Skills for America offers free access to AI training, certificates and resources designed to help workers prepare for the evolving AI economy.

An individual user’s experience may vary, and results are not guaranteed.