Every morning, employees around the region open a browser tab and paste confidential slides, proprietary code snippets and HR documents into public AI chat windows. No dramatic breach alerts. No malicious intent. Just people chasing productivity targets—overstretched, deadline-driven and convinced the tool will make the job faster. This small, habitual action is an underappreciated exit point for corporate secrets.
The quiet exfiltration
At Kopi Meet Up, a monthly gathering founded for people working in security, a recent conversation cut straight to the heart of the issue. Someone shared a tale of a developer who pasted a backlog of source code into a public AI tool because debugging time had run out. Another recounted a project manager summarising meeting notes filled with client names and contract terms. The response around the table wasn’t condemnation. It was frustration—and recognition. This happens daily, in startups and long-established firms alike.
Frustration because the default corporate answer so often looks like a forbidding policy memo on the intranet. Recognition because the reality is obvious: banning tools without offering usable alternatives simply pushes staff to make risky choices in private. That’s the organisational failure, not the individual misstep.
Three shifts that actually change behaviour
First shift: show context, not commandments. Employees don’t need high-minded declarations; they need concrete examples. Which phrases are safe to paste and which must be redacted? When is it acceptable to include a client identifier, and when must it be anonymised? Clear checklists, real-world examples and short decision trees work. A 30-second quick-reference card trumps a ten-page policy every time.
Second shift: make sanctioned tools usable. A locked-down, clunky platform gathers dust. If the official AI environment requires convoluted login steps, a slow VPN and limited functionality, people will gladly use a consumer tool that ‘just works’. Provide platforms with the right access controls, strong supplier assessments and embedded data loss prevention, and make them as frictionless as the public alternatives. Usability is not optional; it’s a security control.
Third shift: distribute ownership. Treating AI risk as solely the chief information security officer’s problem is a recipe for failure. Legal, HR, procurement and business leaders must be accountable. When metrics or commercial pressures drive people to bypass controls, that points to a broader organisational misalignment. Fix the incentives, not only the technology.
Practical steps for SMEs in Singapore
Small and medium enterprises often assume robust AI governance is a big-company luxury. That’s incorrect. Practical steps exist that scale to any budget.
- Create bite-sized guidance: One-pagers, short videos and interactive prompts that live where people work—inside the tools or on the desktop—are more effective than a buried PDF.
- Offer a default safe path: Provide a sanctioned AI environment preconfigured for common tasks: summarisation, code review, draft editing. Remove friction—single sign-on, straightforward templates and fast response times.
- Automate data classification: Lightweight tools that flag sensitive phrases before paste events can prevent leaking without roadblocks. These are not foolproof but reduce risk significantly.
- Train with real scenarios: Use anonymised incidents from day-to-day work. People remember a relatable story far longer than a compliance slide deck.
- Align KPIs with security: Tie performance metrics to safe practice adoption. Reward teams that use approved tools and workflows, not just those who hit deadlines fastest.
Culture over controls
Controls are important—policies, DLP, supplier checks, encryption—but culture determines whether controls are used. When staff feel shamed for raising uncertainties, risky shortcuts become the norm. When leaders admit that speed matters and then provide safe tools to achieve it, behaviour changes.
There’s an emotional element here. A developer who feels the clock ticking and faces a laborious corporate workflow experiences stress, helplessness and urgency. Those feelings drive decisions. Recognising emotion as a risk factor reframes the problem from blame to design: design systems that reduce stress, not amplify it.
Why this matters for Singapore
Singapore’s ambition to be a trusted global digital hub depends on governance as much as technical prowess. Rapid adoption of AI will be valuable only if it’s coupled with clear accountability. Governments, industry associations and firms should push for norms where safe AI usage is the default, not an afterthought.
A final challenge for leaders
Before an employee hits Enter on a public prompt window, leaders must ask a single, unforgiving question: when that data crosses the threshold, who is accountable for protecting it? If the organisation cannot answer with clarity, every copy-and-paste carries risk. Fix the roles, fix the tools, fix the incentives—and the rest follows.
Security is not about stopping innovation. It’s about enabling it responsibly. Safer AI adoption requires practical guidance, usable platforms, shared accountability and cultural empathy. Do that, and the quiet exfiltration stops being a daily gamble.