Between reports to summarize, proposals to draft, and internal documents to search, there’s plenty to keep a team busy. Generative AI (GenAI) can help move that work along, especially when deadlines are tight and the task list keeps growing.
But while teams focus on getting a useful answer, it’s easy to miss what they’re sharing to get it. Contract details, customer records, and snippets of source code can end up in prompts or uploaded files. If the company hasn’t vetted the service, IT may have little visibility into what happens to that data.
GenAI security helps businesses protect data, manage access, and set clear rules for using AI. In this article, we’ll walk through the risks to watch for, how the security layers fit together, and practical steps for using AI more safely at work.
How Can GenAI Put Business Data at Risk?
Because AI is so easy to use, everyday tasks can quickly involve sensitive information. A simple request might include contract terms, source code, or customer records. These two risks show why AI security needs to be part of the way businesses use AI.
Data Exposure Through Prompt Injection and Data Ingestion
Prompt injection occurs when malicious instructions influence how an AI application behaves, including through documents it reads. Attackers may use those instructions to trigger unauthorized disclosures or actions beyond the application’s intended purpose.
Ingestion creates another risk when documents are added to an AI knowledge source. Overly broad permissions can allow the application to retrieve and display information to people who aren’t authorized to see it.
Shadow AI and Indonesia’s Personal Data Protection Law
Shadow AI is the use of AI applications without company approval or oversight. An employee uploading a customer list through a personal account to save time is one example.
That makes it harder to track where data is processed, how long it’s kept, and who can access it. If personal data is involved, these gaps can complicate compliance with Indonesia’s Personal Data Protection Law (UU PDP), including requirements for lawful processing, security, and cross-border transfers.
Two Essentials for Getting GenAI Security Right
Security needs to cover data, user identities, and the applications and model services a business uses. When reviewing the architecture, determine what information can be processed, who can access it, and which controls apply at every step. Start with data protection and access permissions that match each user’s role.
1. Data Loss Prevention for LLM Interactions
Large language models (LLMs) need controls over the information they process. Classify data as public, internal, or confidential, then define how each category may be used. Data loss prevention (DLP) helps inspect prompts and uploads for sensitive information and enforce policies, such as blocking a transfer.
Send only the data needed and use masking where appropriate. Review the results, since masking alone may not eliminate the risk of re-identification.
2. Identity-Based Access with Least Privilege
Least privilege limits access to what each person needs for their role. Using an AI application shouldn’t automatically grant access to every company document.
Review permissions when employees change roles or leave. For applications connected to internal knowledge sources, enforce those permissions during document retrieval so AI responses respect the user’s access rights.
Layering GenAI Security with Zscaler, Okta, and Amazon Bedrock
A layered approach to GenAI security connects data traffic controls, identity governance, and a controlled environment for model processing. Zscaler, Okta, and Amazon Bedrock each support a different part of that architecture. Implementation should reflect the company’s systems and policies. Here’s how their roles fit together.
Zscaler DLP and AI Security for Data Protection
Zscaler AI Access Security helps identify GenAI application use, including shadow AI, and provides visibility into prompts. Policies can restrict which applications are allowed and block services that don’t meet company requirements.
Inline DLP helps block sensitive data transfers and confidential document uploads within its inspection coverage. That coverage depends on the applications, access paths, and modules deployed. Zero trust adds verification based on identity, device, and access context.
Okta Identity Governance for Access Management
Okta Identity Governance supports access requests, approvals, and reviews through Access Requests and Access Certifications. Identity lifecycle management helps provision or remove access as employee status changes.
Request and review histories provide an audit trail for access decisions. Other Okta capabilities can add adaptive authentication, while resource permissions depend on the integrations in place.
Amazon Bedrock for Controlled AI Processing
Amazon Bedrock is a managed service for building GenAI applications with a choice of foundation models. AWS states that inference inputs and responses aren’t used to train AWS or third-party models. Retention terms still need review for the selected model and service settings.
AWS PrivateLink provides private connectivity from an Amazon Virtual Private Cloud (VPC) to Bedrock without using the public internet. Bedrock Guardrails can be configured to block or mask sensitive information in inputs and responses. Companies still need to set access permissions, retention rules, and activity logging.
The table below summarizes each layer and its business value.
Security Layer | Solution | Key Controls | Business Value |
|---|---|---|---|
Data and applications | Zscaler DLP and AI Security | Visibility into AI use, application controls, and prompt inspection | Reduces the risk of sensitive data reaching unapproved services |
Identity and access | Okta Identity Governance | Access approvals, permission reviews, and identity lifecycle management | Helps align access with job requirements and supports audits |
Model processing | Amazon Bedrock | Access controls, private connectivity, and configured guardrails | Supports GenAI development with security and privacy controls |
How Can Businesses Set Clear Rules for Safer GenAI Use?
A GenAI security policy is easier to follow when employees understand the rules and have approved tools available. Define permitted applications, acceptable data categories, approval responsibilities, and incident reporting procedures. These two steps help turn the policy into everyday practice.
Give Employees an Approved AI Environment
Provide access to AI applications the company has reviewed, with permissions based on roles and clear guidance. Use familiar examples, such as removing identifying customer details before requesting a document summary.
Review providers’ terms for data processing, retention, and location. Under UU PDP, personal data processing that presents a high risk requires a data protection impact assessment.
Audit and Monitor AI Activity
Correlate logs from Zscaler, Okta, and AWS within security operations (SecOps) monitoring to investigate policy violations and suspicious access changes.
In Amazon Bedrock, model invocation logging can capture inputs and responses, but it’s disabled by default. Enable it as needed, limit access to the records, and define retention periods because logs can also contain sensitive information.
GenAI Security FAQs
Businesses adopting GenAI security often ask how to protect data, choose a platform, and meet legal requirements. These answers help clarify the decisions involved.
<H3> How Can Businesses Prevent Data Leaks When Employees Use GenAI? </H3>
Classify data, use approved applications, limit access, and apply DLP policies. Zscaler can support application controls and prompt inspection, while employees need clear guidance on which information they may share.
How Does Amazon Bedrock Help Protect Business Data?
Amazon Bedrock provides access controls and encryption. AWS states that inference inputs and responses aren’t used to train AWS or third-party models. AWS PrivateLink can add private connectivity, while retention settings and application security still need configuration.
Does UU PDP Apply to Internal AI Use?
Yes, when it involves processing personal data. Businesses need a lawful basis, a clear purpose, and appropriate safeguards. Explicit consent is one of the legal bases recognized by UU PDP.
Strengthen GenAI Governance with CDT
Ready to make AI a safer part of everyday work? Central Data Technology (CDT), part of CTI Group, can help businesses understand their risks and choose the right security controls.
From protecting data with Zscaler and managing access with Okta Identity Governance to building AI applications on Amazon Bedrock, CDT can help bring these pieces together in a GenAI security plan that fits the way teams work.
Talk to the CDT team to map out the next steps for safer AI adoption.
Author: Danurdhara Suluh Prasasta
CTI Group Content Writer
