Skip to content
All tabletop exercises
AI system·Starter·Mixed audience

Staff have been pasting secrets and customer data into a public AI chatbot

The prompt — read this to the room

Your new data-loss prevention pilot produces its first weekly report. In seven days, staff pasted content into a free public AI chatbot 1,840 times. The sample includes a production database connection string, a customer contract with pricing, two HR investigation notes and a spreadsheet of patient appointment details. Your acceptable-use policy says nothing about AI. The approved enterprise AI tool, bought six months ago, has 30 active users out of 1,200. A department head replies to your email: "Everyone uses it. Banning it will just push people to their phones."

Total duration
1 h
People to involve
6
Best fit
Healthcare, Finance

Who to involve

Most important first.

  • CISO / Head of security
  • Privacy officer / DPO
  • HR
  • Legal counsel
  • IT operations
  • Developer / DevOps

What it tests

  • Decide which pasted items need incident handling, such as rotation or notification, and which do not.
  • Agree a proportionate response to staff behaviour that policy never addressed.
  • Choose between blocking, steering and enabling for public AI tools.
  • Draft the minimum AI acceptable-use rules and the support that makes them work.

Outline of activities

  1. 1The report: what was pasted and how bad it is
  2. 2Incident handling for the worst items
  3. 3People: discipline, amnesty or education
  4. 4Block, steer or enable: the tool decision
  5. 5A workable AI use policy

Run sheet (Pro)

The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.

Loading…

More ai system exercises

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
Staff have been pasting secrets and customer data into a public AI chatbot — Tabletop Exercise · PlayCISO