The Cloud Security Alliance's 2026 survey of 340 financial institutions asked a direct question: what are the three greatest security risks when you use AI? The answer wasn't what the headlines about rogue models would predict. By a wide margin, the top concern was leakage of sensitive data, named by 61 percent. Prompt injection, jailbreaks, and model theft all ranked far below it.
The report puts it plainly. For both cloud and AI, the primary risk is a data problem. Not the model misbehaving. The data leaving.
It doesn't take a breach
The thing that makes data leakage hard to manage is that it mostly happens through normal use. Not an intruder pulling files out. An employee doing their job, pasting something into a tool that helps. The survey ties the 61 percent figure to leakage through prompts, uploaded files, chat history, training data, and the connectors that feed retrieval systems. Every one of those is a path that opens during ordinary work, not during an attack.
The report includes one CISO's account that lands the point. Staff who didn't know the policy pasted customer records into a public chatbot to reconcile them. The security team caught it that time. Most firms don't have the monitoring to catch it at all, which is the quieter finding underneath the number.
Where the data actually goes
Underneath the headline figure, the survey maps the specific paths, and they cluster around access and architecture rather than clever attacks.
- Excessive agent permissions, 33%. Weak authorization for AI agents and the tools they call. An agent with more reach than it needs becomes a way to pull data nobody meant to expose.
- RAG and retrieval-connector exfiltration, 27%. This is the subtle one. Retrieval-augmented generation, the standard way to point a model at your own documents, has a quiet flaw: similarity search does not, on its own, respect who is allowed to see which document. Ask the right question and the system can return content the person asking was never cleared for. Vector databases also tend to lack the row-level security, field-level encryption, and audit trails that any other data store in a bank would be required to have.
- Model-behavior disclosure, 23%. Sensitive data surfacing through the model itself, including training-data leakage and inference attacks.
- Credential and secret exposure, 19%. API keys, tokens, and system prompts leaking through plugins and integrations.
For contrast, the attacks people picture first sit at the bottom of the list. Prompt injection and jailbreaks came in at 19 percent, data poisoning at 10 percent, and model theft at 3 percent. The survey reads this as a sector that has, reasonably, decided the immediate exposure is its own data moving through everyday tools, not an adversary reaching in.
The root cause is a data problem most firms haven't solved
There's a reason leakage tops the list, and it sits one layer down. Twenty-six percent of respondents named data classification and policy-maturity gaps as a barrier to deploying AI safely. The report calls classification the prerequisite control, and the logic is hard to argue with. If you can't reliably label what's sensitive and track where it lives, you can't enforce what an AI system is allowed to read, train on, or repeat in an answer. The leakage is downstream of that gap.
The same blind spot shows up in oversight. Lack of auditability, traceability, or monitoring for AI-driven actions was cited by 23 percent, nearly matching the data-disclosure concerns. Firms are worried not only that data leaks, but that they can't reconstruct how or when it did.
Most AI security attention goes to keeping attackers out of the model. The survey says the money risk is the opposite direction: sensitive data walking out through normal, sanctioned use. You can harden the model perfectly and still lose the data, because the data was handed over a prompt at a time by people doing their jobs.
What the survey says to do
The recommendations are concrete, and they start with the unglamorous prerequisite.
- Classify the data first. Know what's sensitive and where it lives before you point AI at it. Everything else depends on this.
- Enforce permissions at the retrieval layer. Retrieval should respect who is allowed to see what, so a model can't return a document the user isn't entitled to.
- Put guardrails on input and output, and review the tools agents can call for least privilege, so a connector built for one task can't be turned to another.
- Monitor for drift, anomalous output, and extraction attempts, with logs you can actually reconstruct an incident from.
Notice what these have in common. Every one is easier to enforce when the data and the model sit inside a boundary you control, and much harder when prompts, files, and retrieval are crossing into a service you don't.
Where Cognetryx fits
We build private AI for regulated institutions, and data leakage is the problem the architecture is built to remove rather than monitor.
- The data never leaves. Prompts, uploaded files, chat history, and any fine-tuning happen inside your environment, not on a public AI service. The most common leak path in the survey, ordinary use of an outside tool, simply isn't there. See banking AI without the public cloud.
- Retrieval respects permissions. Our retrieval layer enforces entitlements inside the query, so the model can't surface a document the person asking isn't cleared for. That closes the 27 percent RAG-exfiltration path directly. More on permission-aware RAG.
- Classification and control are enforceable because the data and the model are in one boundary you govern, rather than spread across a platform that can't see your labels. See private LLMs and where your data lives.
- Every answer is auditable. Immutable logs of what was asked, what was retrieved, and what came back, which is what the 23 percent worried about traceability are missing.
The survey frames data leakage as the dominant AI risk in finance and a data problem at its core. That's the problem we set out to solve, and the cleanest way to solve it is to stop sending the data out in the first place.
Source: "State of Cloud and AI for Financial Services 2026," Cloud Security Alliance, sponsored by Anjuna. Based on 340 survey responses collected January 15 to March 1, 2026. Figures and quotations are drawn from the report and used under fair use with attribution to the Cloud Security Alliance. Read the full report at cloudsecurityalliance.org.
Keep the data in the building
Book a short demo and watch a private model answer real questions on your own documents, with nothing leaving your environment.
Request a Demo