Finance workers share sensitive data with AI tools

Research by CybSafe and the National Cybersecurity Alliance found that 42 per cent of finance and insurance workers who use AI at work have shared sensitive information with AI tools without their employer's knowledge, compared with 32 per cent of workplace AI users overall.

The findings are based on a survey of 5,000 adults in the UK, US, India, Brazil and Singapore, including 308 employed respondents in finance and insurance. It found that 72 per cent of finance and insurance respondents use AI at work, suggesting the issue affects a large share of the sector's workforce.

The data adds to a wider debate over how financial institutions govern staff use of AI, particularly as regulators examine whether internal controls match day-to-day working practices. The Financial Conduct Authority has highlighted cases in which firms introduced AI before putting clear governance and escalation routes in place.

Although finance and insurance workers reported greater access to cybersecurity training than employees overall, the results suggest training alone may not prevent risky behaviour. The survey found that 75 per cent of finance and insurance respondents have access to cybersecurity training, compared with 60 per cent of employed respondents across all sectors.

Workplace habits

The report highlights a gap between formal policy and routine behaviour. In practice, that means whether employees know what information can safely be entered into AI tools, whether they can independently verify unusual requests and whether they have a clear route to raise concerns.

These questions have become more pressing as generative AI tools spread through office work, including in heavily regulated industries that handle customer data, market-sensitive information and internal financial records. The survey suggests convenience and speed may, in some cases, outweigh internal reporting lines or employer rules.

Oz Alashe, Chief Executive Officer and Founder of CybSafe, said the issue for firms is not simply whether controls exist on paper, but whether employees can use them in ordinary working conditions.

"Financial firms need evidence that security controls work during an ordinary working day. That means understanding how people handle sensitive information and what happens when a convincing request arrives. Approved processes need to fit the job, and firms need to measure whether people can use them effectively," Alashe said.

Impersonation risk

The survey also pointed to concern over scam calls using realistic voices or appearances. In the UK, 22 per cent of respondents said they had received a scam phone or video call in which the caller's voice or appearance closely matched someone they recognised.

Of those respondents, 36 per cent said they or their employer lost money or data as a result. The finding underlines the exposure created by social engineering attacks that rely on pressure, urgency and familiarity rather than direct technical intrusion.

Dr Suzie Dobrontei, Behavioural Scientist at CybSafe, said employers need to make verification practical for staff dealing with persuasive or time-sensitive requests.

"A convincing request can arrive when someone is busy and trying to help. Employers need to understand what makes checking difficult in that moment. Give people a practical way to verify the request independently and support them when they pause or raise a concern. Then test whether that support changes what happens," Dobrontei said.

Governance questions

The findings come as financial regulators place greater emphasis on outcomes rather than policy documents alone. The FCA has recently pointed to cases in which oversight responsibilities for AI were unclear across teams, leaving staff without a clear path to escalate issues or challenge decisions.

That makes employee behaviour a central issue for boards and compliance teams. If staff are using AI tools widely, firms need to determine not only whether approved systems are available, but also whether workers understand the limits on data sharing and follow them under pressure.

Professor Jason Nurse, Director of Science and Research at CybSafe, said organisations should measure whether support systems change behaviour over time rather than assume controls are effective.

"Organisations should establish a baseline, understand the barriers people encounter and test whether changes to their support improve those behaviours over time. Steps like providing safe, approved AI tools and ensuring training sessions clearly outline the reasoning behind rules are good, but it is just as important to measure exactly how much effect these changes are having. That is how you go from piecemeal improvements to building a robust security culture."

He added: "One good security habit does not tell us whether someone takes the next step. We need to measure behaviours directly, understand what gets in the way and test whether the support people receive makes a difference."