AI and Cybersecurity What Employees Should Never Put Into ChatGPT or Other AI Tools

October is Cybersecurity Awareness Month.

And this year, there’s a cybersecurity conversation I think every mid-sized organization needs to have with its employees.

What information should—and shouldn’t—go into artificial intelligence tools?

I was talking with a business leader recently about AI when she said something I’ve heard more than once:

“Brett, I’m pretty sure our employees are already using it. I’m just not sure what they’re putting into it.”

That’s the real issue.

Employees are discovering that AI can help write emails, summarize information, brainstorm ideas, create meeting notes, analyze documents, and save time.

Those can be useful capabilities.

But imagine an employee has a long document and thinks:

“I’ll just paste this into an AI tool and ask it to summarize it.”

Simple enough.

Except the document contains customer information.

Or internal financial information.

Or employee information.

Or cybersecurity details.

Now you’ve got a very different conversation.

The question isn’t whether mid-sized organizations should fear AI.

They shouldn’t.

The question is:

How do we help employees use AI without creating unnecessary cybersecurity, privacy, or compliance risk?

Cybersecurity Awareness Month is the perfect time to start that conversation.

1. Don’t Put Customer Information Into Unapproved AI Tools

Let’s start with the most obvious category.

Customer information.

Employees should not assume it’s appropriate to enter sensitive customer information into a public or otherwise unapproved AI service.

That could include things such as:

Account information

Social Security numbers

Dates of birth

Loan information

Customer contact information

Transaction details

Identification documents

Other confidential customer records

A good rule is simple:

If you wouldn’t put the information on a public website, don’t paste it into an unapproved AI tool.

Your organization should determine which AI services, if any, are approved for business use and establish clear rules around the information those services may process.

Employees shouldn’t have to guess.

2. Protect Employee Information Too

Customers aren’t the only people whose information matters.

HR and employee information can also be sensitive.

Imagine a manager wants help writing a performance review.

They paste an employee’s previous evaluations, salary information, disciplinary history, and personal details into an AI tool and ask:

“Can you summarize this employee’s performance?”

AI may produce a useful answer.

But the bigger question is:

Should that information have been entered into that system in the first place?

Employee records, compensation information, medical or benefits information, credentials, and other confidential HR information need appropriate protection.

Convenience shouldn’t override confidentiality.

3. Don’t Share Passwords, Credentials, or Security Information

This one sounds obvious.

But it deserves to be said.

Employees should never use an AI chatbot as a place to store or troubleshoot sensitive authentication information.

Don’t paste in:

Passwords

MFA codes

API keys

Private security keys

Administrative credentials

Recovery codes

Other authentication secrets

Be careful with cybersecurity information too.

An employee troubleshooting a problem might be tempted to paste detailed network configurations, security reports, vulnerabilities, or system information into an AI tool.

That’s another reason your organization needs guidelines.

The more sensitive the information, the more carefully the tool should be evaluated and approved.

4. Be Careful With Internal Documents

Here’s where the line can become less obvious.

What about an internal report?

Leadership presentation?

Strategic plan?

Cyber insurance application?

Vendor contract?

Risk assessment?

Incident response plan?

Just because something doesn’t contain a Social Security number doesn’t mean it isn’t confidential.

Before uploading or pasting an internal document into an AI system, employees should understand whether the tool is approved for that type of information.

A useful question is:

“Would I be comfortable sending this document to an outside company I hadn’t evaluated?”

If the answer is no, stop.

5. AI Answers Still Need Human Review

Cybersecurity isn’t the only risk.

AI can produce information that sounds confident and professional while still being incomplete, outdated, or wrong.

That’s especially important in a business environment.

Suppose someone asks AI:

“What does the appropriate regulator require us to do in this situation?”

The response may sound convincing.

That doesn’t make it official regulatory guidance.

The same goes for legal questions, compliance decisions, cybersecurity configurations, and financial information.

AI can help people work.

It shouldn’t automatically become the final decision-maker.

Use AI to assist human judgment—not replace it.

6. Watch for AI-Powered Social Engineering

There’s another side to AI.

Your employees can use it.

Attackers can too.

AI can help make fraudulent messages more polished and convincing.

That means some of the old advice about phishing is becoming less reliable.

You can’t assume a message is legitimate because:

The grammar is good

It sounds professional

It uses the executive’s normal style

It references real people

It appears knowledgeable about the organization

The better defense is process.

If a request involving money, credentials, confidential information, or system access seems unusual, verify it through a trusted channel.

As attacks become more convincing, verification becomes more important.

7. Create an AI Acceptable-Use Policy

Telling employees:

“Don’t use AI.”

probably isn’t much of a strategy.

A better approach is to create clear guidelines.

Your AI acceptable-use policy can address questions such as:

Which AI tools are approved?

What information can employees enter?

What information is prohibited?

Can employees upload documents?

How should AI-generated work be reviewed?

Who approves new AI tools?

How are vendor AI features evaluated?

Who should employees ask when they’re unsure?

Keep it understandable.

A policy nobody can interpret won’t help much.

Use the STOP Framework Before Entering Information Into AI

For Cybersecurity Awareness Month, give employees something simple to remember.

Before entering business information into an AI tool, STOP.

S — Sensitive

Does this contain customer, employee, confidential, financial, security, or other sensitive information?

T — Tool

Is this AI tool approved by the organization for this type of use?

O — Ownership

Do we understand how the tool handles the information we provide and what organizational policies apply?

P — Pause

If you’re uncertain, don’t paste it.

Ask first.

Sensitive. Tool. Ownership. Pause.

Four questions can prevent a lot of unnecessary risk.

Ask Employees One Question This Month

During Cybersecurity Awareness Month, ask your staff:

“If you wanted to use AI to summarize a document today, would you know which documents you’re allowed to upload?”

Listen to the answers.

If one person says yes…

Another says no…

And three others say:

“I never thought about it.”

You’ve identified a training opportunity.

Your employees don’t need a 50-page AI manual.

They need clear, practical guidance they can use when they’re sitting at their computers deciding whether to click Upload.

What Should Leadership Do Next?

Start with five steps.

First: Find out which AI tools employees are already using.

Second: Identify what information should never be entered into unapproved tools.

Third: Establish approved tools and acceptable uses.

Fourth: Train employees using real examples.

Fifth: Review AI usage as part of your quarterly cybersecurity and technology meetings.

And remember that AI governance isn’t a one-time project.

The technology will continue changing.

Your vendors will introduce new AI features.

Employees will find new tools.

Your policies and training will need to evolve with them.

Final Thoughts

AI can be tremendously useful.

I don’t think mid-sized organizations should run away from it.

I think they should approach it thoughtfully.

Give employees useful tools.

Give them clear rules.

Protect sensitive information.

Evaluate vendors.

Verify important outputs.

Teach people to recognize AI-enabled scams.

And make it easy to ask questions.

Cybersecurity Awareness Month isn’t about making employees afraid to use technology.

It’s about helping them use technology wisely.

Before somebody copies information into ChatGPT, Copilot, or another AI platform, teach them to STOP.

Is it sensitive?

Is the tool approved?

Do we understand how the information is handled?

Should I pause and ask?

That’s a small habit.

But small habits can protect something very important.

Customer trust.

Does Your Organization Have an AI Security Strategy?

If employees are already experimenting with AI but your policies haven’t caught up, Cybersecurity Awareness Month is a good time to start the conversation.

At CTG, we help mid-sized organizations evaluate how AI, Microsoft 365, cybersecurity, identity management, data protection, vendor risk, business continuity, and long-term technology strategy fit together.

We can help your leadership team identify appropriate AI opportunities, evaluate technology risks, develop practical usage guidelines, and create a roadmap that allows your organization to innovate without forgetting the responsibility to protect sensitive information.

For more than 26 years, CTG has helped organizations navigate technology change, backed by a team with more than 200 years of combined experience.

And because we’re vendor-agnostic, the conversation begins with your organization’s goals, risks, and people—not a particular AI product.

This Cybersecurity Awareness Month, don’t simply ask:

“Are our employees using AI?”

Ask:

“Are we helping them use it responsibly?”

Talk with Brett Harney at Corporate Technologies Group

Phone: 330-655-8144
Email: brett.harney@ctgusa.net
Website: ctgusa.net

Let’s put practical guardrails around AI so your organization can explore what’s possible while continuing to protect the people who trust you.