In recent years, as AI applications have advanced, enterprises have begun using AI Agent to review contracts, respond to customers, and organize quotations. As a result, the range of data accessed by AI has also expanded.
In its 2025 Cost of a Data Breach Report, IBM examined AI-related security and governance for the first time. It found that 13% of organizations had experienced a breach involving an AI model or application, and 97% of those organizations lacked proper AI access controls. OWASP ranks prompt injection and sensitive information disclosure as the first and second risks on its list of security risks for large language model applications.
As organizations deepen their use of AI, they need a checkpoint between their applications and AI models—an AI Gateway. Only enterprises that establish this checkpoint early can confidently allow AI Agent to process real business data.
What Is an AI Gateway, and Why Is Content Protection Its Most Critical Component?
An AI Gateway is a unified entry point positioned between enterprise applications and AI model providers. Every model request passes through it first, allowing the gateway to process the request, route it to the appropriate model, control usage, and retain records.
An AI Gateway typically provides a unified API entry point, routing and failover, caching and rate limiting, cost tracking, and content protection guardrails. The first several capabilities primarily affect cost and stability. If they are not configured optimally, the consequences are usually limited to higher expenses or longer wait times.
Content protection, however, safeguards data and corporate reputation. Once customers’ personal information has been sent to an external model, or AI has been misled by instructions hidden in a document, remediation is often extremely difficult. Drawing on reports from leading organizations, the following sections examine the two main categories of risk that content protection is designed to intercept.
Risk 1: Employees Send Sensitive Data to AI Due to Insufficient Security Awareness
In its 2026 AI Adoption & Risk Report, Cyberhaven analyzed how enterprises and employees use AI. It found that 39.7% of AI interactions involve sensitive data, including text entered into prompts, copied-and-pasted content, and uploaded files.
On average, an employee enters sensitive data into an AI tool once every three days.
The report also found that a significant share of AI usage occurs through personal accounts. For example, 32.3% of ChatGPT usage comes from personal accounts. Personal accounts bypass enterprise single sign-on (SSO), centralized logging, and data retention policies. As a result, security teams cannot see where data is going and are therefore unable to manage the associated risks.
IBM’s research adds another perspective by examining the outcomes of security incidents. One in five surveyed organizations had experienced a data breach caused by “shadow AI”—AI tools used by employees without authorization. Organizations with high levels of shadow AI usage incurred average breach costs US$670,000 higher than organizations with little or no shadow AI usage.
Losses from these incidents were also more heavily concentrated in sensitive data. According to IBM, 65% of incidents involving shadow AI resulted in the exposure of personally identifiable information, compared with an overall average of 53%. Intellectual property was exposed in 40% of shadow AI incidents, compared with an overall average of 33%.
In its guidance on sensitive information disclosure, OWASP also identifies personal data exposure as a common scenario. It recommends using techniques such as pattern matching to detect and mask confidential content before data is processed by a model. This is precisely what AI Gateway content protection must do on the outbound side.
Risk 2: Prompt Injection Hidden in External Content
Prompt injection is a security vulnerability in which input causes a large language model’s behavior or output to deviate from its original design. OWASP ranks it as the number-one risk for LLM applications.
OWASP divides prompt injection into two categories:
- Direct injection: Content entered by users themselves, either as a deliberate attack or an unintentional trigger.
- Indirect injection: Content originating from external sources accessed by the model, such as websites or files.
Indirect injection poses a particularly significant risk to enterprise AI Agent. The work performed by AI Agent naturally includes reading web pages, searching knowledge bases, and processing documents received from customers and suppliers. Every external source could contain embedded instructions.
OWASP also warns that prompt injection content does not need to be visible to humans. It may take effect as long as the model can parse it. A seemingly ordinary quotation or web page could contain instructions that are invisible to the human eye but that the model will nevertheless follow.
When AI Agent can retrieve data, send emails, or write to enterprise systems, the consequences of being misled can escalate from an incorrect answer to a real-world action. Therefore, external content retrieved from websites, knowledge bases, and tools must also be inspected before AI can read it.
Why Aren’t Prompts and Employee Policies Enough?
For many enterprises, the first step is to include instructions such as “Do not output personal information” in the system prompt or to tell employees not to submit customer data to AI.
OWASP notes that restricting the types of data a model may output through the system prompt can indeed reduce risk. However, as the amount of contextual content increases, these restrictions may not always be followed and can even be circumvented through prompt injection.
The gaps in organizational policies are equally apparent. IBM’s report found that 63% of breached organizations had either not established an AI governance policy or were still developing one. Overall, only 37% of organizations had policies for managing AI or detecting shadow AI. Blocking AI entirely does not solve the problem either. Cyberhaven has observed that AI is now used by almost everyone, and broad restrictions rarely reduce risk in practice. Instead, they push usage beyond formal controls, giving enterprises even less visibility into where their data is going.
All three sources agree on one point: controls must operate outside the model, at a point through which every request passes. AI Gateway content protection occupies exactly this position. It does not depend on the model to follow rules by itself, nor does it rely on every employee remembering the policies every time.
What Does This Mean for Traditional Industries Adopting AI Agent?
In traditional industries, sensitive data is often concentrated in a small number of document types: quotations, orders, customer and supplier records, personnel records, and manufacturing drawings. Before adopting AI Agent, enterprises can use the findings from the reports above to verify that their content protection covers the following areas:
- Inspection across three directions: Messages and files submitted by employees, content retrieved by AI from external sources, and AI-generated responses—especially responses sent directly through external channels such as LINE.
- Personal data categories tailored to local requirements: Rules should be able to recognize common Taiwanese formats, including national identification numbers, Unified Business Numbers, and National Health Insurance card numbers.
- Tiered enforcement options: General contact information may only need to be logged, national identification numbers can be masked, and API keys and credit card numbers should be blocked outright. This avoids disrupting daily operations with blanket restrictions.
- The ability to observe before enforcing: During the initial deployment phase, events can be logged without being blocked. Enforcement can then be enabled once the false-positive rate has been confirmed to be acceptable.
- Post-event traceability: Blocked or masked content should be recorded so administrators can flag false positives and approve exceptions when necessary.
EgentWrX provides one example. Based on company policies, the platform’s Content Protection module inspects user messages, uploaded files, responses generated by digital twins, and results returned from websites, knowledge bases, and service endpoints. A digital twin is the platform’s AI Agent, built across three layers: position (Agent), responsibility (Task), and competency (Skill).
Content Protection can identify categories such as national identification numbers, Unified Business Numbers, bank account numbers, National Health Insurance card numbers, and credit card numbers. Depending on policy settings, it can log, warn, mask, retract, or block the content. Prompt injection, prohibited topics, and inappropriate language that cannot be detected through rules are evaluated by an AI Judge. API keys and credentials are treated as non-negotiable platform safeguards and are blocked regardless of policy settings.
Administrators can first accumulate events in observation mode and run tests in the testing console before switching to enforcement mode. Protection for individual digital twins can also be configured more strictly than company-wide policies. Enterprises should first identify the departments most likely to submit customer and transaction data to AI. They can begin by configuring policies for those departments, observe usage for one to two weeks, and then gradually expand the controls across the organization. Once the data checkpoint is in place, AI Agent can move beyond pilot projects and become part of everyday business operations.
FAQ
Our company already prohibits employees from submitting personal information to AI. Do we still need content protection?
Yes. Cyberhaven’s report shows that employees enter sensitive data into AI tools once every three days on average, and a significant amount of usage occurs through personal accounts that bypass enterprise controls. OWASP also notes that restrictions written into system prompts can be circumvented. Controls must therefore operate at a point through which every request passes.
Is prompt injection really relevant to an ordinary enterprise?
Yes. According to OWASP, indirect prompt injection can be hidden in websites or files and does not need to be visible to humans. Any AI Agent that reads web pages, knowledge bases, or documents from customers and suppliers may encounter this type of content.
Will content protection interfere with normal work?
Its impact can be minimized through tiered enforcement and an observe-before-enforcing approach. General information can simply be logged, while only high-risk data is masked or blocked. During the initial deployment phase, events can be logged without being intercepted. Broadly blocking AI may instead push users beyond the reach of enterprise controls.
Are AI Gateway and content protection the same thing?
Content protection is one component of an AI Gateway. An AI Gateway serves as the unified entry point between applications and models, with capabilities that also include routing, failover, caching, and cost tracking. Content protection is the component responsible for inspecting data and instructions, and it has the most direct impact on preventing data breaches and protecting corporate reputation.
References
- IBM, “IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls”, official press release for the 2025 Cost of a Data Breach Report
- OWASP Gen AI Security Project, “LLM01:2025 Prompt Injection”, LLM application risk list published by a nonprofit cybersecurity organization
- OWASP Gen AI Security Project, “LLM02:2025 Sensitive Information Disclosure”, LLM application risk list published by a nonprofit cybersecurity organization
- Cyberhaven, “AI Data Security Risks: 39.7% of AI Use Involves Sensitive Data”, summary of the data loss prevention provider’s 2026 annual report
