Security in the age of AI: protecting data from intelligent threats and leaks

On 30 October 2026 I presented “Segurança na Era da IA: Protegendo Dados Contra Ameaças Inteligentes e Vazamentos” (Security in the age of AI: protecting data from intelligent threats and leaks) at Conecta TI 2026, hosted by Natercoop. I gave the talk in Portuguese. This is an English edition of the slide content, in three acts: the landscape, where companies are exposed, and what to do.

I opened with a question for the chat: who here pasted work text into an AI this week? And in which account, the company’s or a personal one? That is where the topic begins.

1. The landscape

Three changes arrived at once

• Employees adopted AI on their own, often through personal accounts, to get more done.
• Attackers use AI for more convincing scams (phishing with flawless grammar, cloned voices and video) and for scanning at scale.
• Incidents became more expensive and stop operations.

All three forces converge on the same point: the company’s data and operations.

The average cost of a breach went up

According to IBM’s Cost of a Data Breach Brazil 2026 report, the average cost of a data breach in Brazil rose from R$ 7.19 million in 2025 to R$ 7.44 million in 2026, an increase of about 3.5%. That is the study’s average, not a forecast for any particular company.

Brazil’s data protection law already applies to data put into AI

There is no need to wait for an AI-specific law: under the LGPD, a company is accountable for the personal data it processes, with or without AI. If a leak is suspected:

1. Identify whether personal data was sent or exposed.
2. Validate the incident and what was affected.
3. Escalate to legal and the data protection officer, who assess notification to the ANPD and to data subjects.

This is general guidance; every case needs legal review.

AI already speeds up stages of real attacks

• November 2025, Anthropic. In an espionage campaign, AI carried out most of the activity; human operators stepped in at 4 to 6 decision points. Anthropic estimates that AI performed 80% to 90% of the campaign’s activity. The campaign targeted around 30 organizations, with a small number of confirmed intrusions, and the AI also hallucinated results.
• September 2026, Google Threat Intelligence. In one specific campaign in Q2 2026, after compromising a cloud resource, agents planned, built and executed credential harvesting in under six hours. That is one case, not a market average, and not a full intrusion in six hours.

The takeaway: AI speeds up stages of an attack and adds assets to protect: data, connectors, agents and keys.

PHP2Shell: from discovery to exploitation

A case of AI-assisted defensive research shows how short the window between discovery and exploitation can be:

• 1 Aug 2026: Calif discovers the flaws, in research supported by AI.
• 17 Oct 2026: AWS records an exploitation attempt in its MadPot honeypot, before public disclosure.
• 21 Oct 2026: PHP ships fixed releases (8.2.35, 8.3.36, 8.4.27 and 8.5.12) for CVE-2026-109618 and CVE-2026-109619.
• 29 Oct 2026: Palo Alto Networks confirms active exploitation against PAN-OS with the management interface exposed to the internet.

An attempt seen in a honeypot and confirmed exploitation have different scopes. AI supported the defensive research; there is no evidence that AI was used in the exploitation. The lesson is the sequence: inventory, prioritize exposed assets, update, and check for compromise.

2. Where we are exposed

Shadow AI: AI used at work without the company knowing

The employee wants to save time, with no bad intent, and uses an unapproved tool: a personal account, a browser extension, a meeting recorder, an assistant connected to email and drive. Into the prompt go contracts, spreadsheets, customer and member data, code, passwords and keys. Under personal-account terms, providers may retain the data and use it for training.

The company cannot see what left, or where it went. Nobody is acting in bad faith; what is missing is an official path.

Connected assistants can follow hidden instructions

Here AI is the target. In prompt injection, an email, document or web page carries a hidden instruction that the assistant reads. The chain has four steps, and each one calls for a control:

Step	What can go wrong	Control
Content arrives	An email or document carries a hidden instruction	Treat external content as untrusted
The assistant reads	It accesses more data than the task requires	Least privilege: only what is needed
The assistant acts	It may follow the malicious instruction	Human confirmation for sensitive actions
Data leaves	Information is sent outside	Block and log outbound data

The historical case is EchoLeak (CVE-2025-32711), a zero-click flaw in Microsoft 365 Copilot in 2025, since fixed by Microsoft. It is a lesson, not an open risk. Least privilege does not remove the risk, but it reduces the impact.

Deepfake video scams already work

In Hong Kong in 2024, a finance employee at Arup made several confidential transfers totalling about US$ 25 million, after a video call with the “chief financial officer” and colleagues. All of them were deepfakes.

The control is a process one: any payment request by video, audio or message is confirmed through a second, previously registered channel, never through the contact details that came with the request.

The attack surface left the perimeter

The traditional perimeter (network and servers) is now a small part of what needs protecting. Today’s surface includes identities, SaaS, APIs, third parties, data and AI agents, with their connectors and keys. Attackers start with what is exposed: leaked credentials and forgotten assets open the door, and AI agents are a new kind of access to protect.

3. The answers

Governance on three pillars

Banning everything pushes usage into the shadows. The shared goal is to protect data and keep the business running.

• People: clear owners and training built on real cases.
• Process: usage rules, second-channel confirmation and incident response.
• Technology: least privilege, visibility (inventory, DLP, AI events in monitoring) and data protection.

Business, IT, security and privacy decide together.

The response has two fronts

• Security for AI, to protect its use: an official AI tool, under a contract that defines purpose, retention and access; clear rules and training; least privilege for assistants and agents.
• AI for security, to defend better: 24/7 monitoring and response; continuous watch over external exposure; vulnerabilities prioritized by risk.

Usage rules that fit on one page

• Go ahead: public text, ideas, drafts without customer names and general questions.
• Official tool only: internal documents, reports, code and customer or member data, as the contract and permissions allow.
• Never: passwords, tokens and keys, sensitive personal data and undisclosed strategic information.

An official tool does not make any data safe: the contract and policy define purpose, retention, access and handling. And in every case, the AI’s answer is a draft; a person reviews it before using it.

In the SOC, AI investigates and a person decides

1. Detect: AI monitors signals 24/7.
2. Investigate: AI gathers context and evidence.
3. Decide: an analyst validates and decides.
4. Respond: containment happens with approval.

Every step records what the AI saw, what it suggested and who decided. According to IBM, Brazilian organizations with extensive use of AI and automation in security reported an average breach cost about 30% lower. That is an observed correlation, not a guarantee.

A 90-day plan in three stages

• See (days 1 to 30): AI and asset inventory; official tool and policy. Who: IT, Security and business units. Outcome: inventory approved and policy published.
• Control (days 30 to 60): least privilege; data protection and fixing priority exposures. Who: IT, Security and Privacy. Outcome: access reviewed and priority exposures fixed.
• Sustain (days 60 to 90): monitoring; incident simulation and training. Who: Security, HR and Legal. Outcome: simulation run and teams trained.

The plan paces how capability grows; it is not a reason to delay the response to a critical risk. Exploited critical flaws, leaked credentials and exposed management interfaces call for immediate assessment and containment.

A checklist to take away

1. Do we know which AI tools are in use and what is exposed to the internet?
2. Does each assistant and agent have only the access it needs?
3. Are payment requests confirmed through a second channel?
4. If data leaks through an AI tool, do we know who acts and how?

Every “no” becomes an item in the plan. The summary fits in one sentence: give people an official path that is easier than the shortcut, and bring AI over to the defense.

Thanks to Natercoop for the invitation to Conecta TI 2026.