How to Secure GenAI Usage in the Enterprise

Securing GenAI usage matters because generative AI is now part of daily work, and every prompt can carry sensitive data. Employees use GenAI to write code and summarize documents in seconds, while CISOs work to keep source code, customer records, and intellectual property from leaving the organization through those same prompts.

The Zscaler ThreatLabz 2026 AI Security Report found that enterprise AI and machine learning (ML) transactions rose 91% year over year in 2025, reaching 989.3 billion across the Zscaler Zero Trust Exchange™ platform. Data volume followed: 18,033 TB of corporate data flowed to AI and ML applications, a 93% increase.

ChatGPT alone generated over 410 million data loss prevention (DLP) policy violations as users tried to share sensitive intellectual property and source code.

According to the same report, enterprises blocked 39% of AI and ML transactions in 2025. Blocked transactions often indirectly encourage employees to use unsanctioned tools. Unrestricted access, which allows open use of any AI app without data controls, puts intellectual property and customer trust at risk.

To safely adopt AI with confidence, organizations should adopt a secure-by-design zero trust architecture.

From blocked to enabled: How zero trust secures GenAI usage

Zero trust secures GenAI usage by continuously verifying the user, device, application, and content of every AI session. Unlike static controls, which make one decision per destination, continuous controls evaluate each prompt and upload in real time and can change their decision the moment risk changes.

A static control, such as an IP block list or URL filter, makes one decision based on the destination and applies it to every session. If the AI domain is approved, all traffic passes, whether the prompt asks for a recipe or contains source code.

A continuous control keeps checking throughout the session. It evaluates the identity of the user, the health of the device, the specific application, and the content of each prompt and upload. It can change its decision the moment any of those factors change.

This difference matters because GenAI risk lives in the payload. Static tools verify the address but ignore the content of the prompt, the uploaded file, and the model’s response, so sensitive data in transit goes unchecked. Their lists also need manual updates, and new AI apps can be deployed faster than any list can grow. Continuous controls apply policy to every request in real time.

Zero trust changes what security teams inspect. Instead of trusting a destination, it evaluates every request on its own merits, using live context about who is asking, from which device, and what the content contains. The Zscaler Zero Trust Exchange applies this model inline, between users and AI apps, so policy decisions happen before data leaves the organization.

Three core zero trust capabilities make that verification practical:

• Continuous asset discovery: It all starts with full visibility. Automated discovery enables the identification of shadow AI tools, custom-built models, and third-party SaaS integrations with embedded AI features.
• Granular access control: Identity is what drives every decision. Policies grant access to internal or high-risk LLMs to authorized personnel only. Rules adapt to role, device posture, and risk level.
• Browser isolation: Browser isolation streams external LLM sessions to the user as safe pixels. Employees get read-only interaction with the model. Administrators can restrict pasting, uploading, and downloading inside the session.

“Zero trust mandates continuous verification of identity and trustworthiness of users, devices, and networks, regardless of their location or whether they are inside or outside the network perimeter.”

– Ankit Gupta, Sr. Product Marketing Manager, Zscaler

Comparing GenAI security approaches

How to prevent data leakage in GenAI workflows

The most critical step in preventing data leakage in GenAI workflows is keeping proprietary data out of public LLMs. Source code, customer records, and API keys submitted in a single prompt can leave enterprise control permanently, and some public models may use submitted content for training. Prevention must happen before the data leaves the network.

Enable inline SSL inspection and real-time DLP

Nearly all GenAI traffic is encrypted, so inspection starts with decrypting it. Inline SSL inspection opens each session at scale, and the content then passes through data loss prevention (DLP) engines in the same pass.

Context-aware DLP reads the prompt itself. It weighs the user, the destination app, and the data type, then decides whether to allow, redact, or block. This intercepts file uploads and copy-paste events as they happen. For example, a developer can ask an LLM to explain a public algorithm, but a prompt containing an internal API key is stopped.

Enforce Cloud Browser Isolation for safe research

Browser isolation lets employees use GenAI tools safely. The AI session runs in a secure cloud container, away from the employee’s device, which receives only a live image of the page, much like a video stream.

“Cloud Browser Isolation renders web content in the cloud, and streams threat-free web page content to users, preventing web-based threats from reaching and infecting employee devices…By isolating web content in the cloud, CBI provides enhanced protection against web-based threats, simplifies security management, and supports remote work.”

– Niraj Gopal, Head of Product Management, Federal and Sovereign Clouds, Zscaler

Employees can still read, research, and learn from the model. CBI blocks clipboard transfers and enterprise file uploads, so productivity continues while sensitive data remains protected.

Security concerns for custom-built LLMs and autonomous agents

Enterprises that build their own AI apps or deploy multiagent systems through the Model Context Protocol (MCP) face three prevalent risks:

• Prompt injection: Attackers trick models into following hidden instructions.
• Data poisoning and model tampering: Attackers corrupt training data or alter the model itself.
• Unauthorized agent actions: Autonomous agents may run tools or call APIs without authorization.

These weaknesses are easy to exploit. In red team testing for the ThreatLabz 2026 AI Security Report, Zscaler found critical vulnerabilities in 100% of the AI systems tested, with a median time to first critical failure of 16 minutes.

Regulatory expectations

Under the EU AI Act, providers of general-purpose AI models must maintain technical documentation covering the model’s training and testing process and the data used for training, testing, and validation. According to the European Commission’s guidelines, an organization that fine-tunes a model becomes the provider of a general-purpose AI model only when the modification uses more than one-third of the original training compute.

The EU AI Act also sets separate risk management and documentation duties for high-risk AI systems. Teams should record datasets, security controls, and risk assessments from the start.

Containing a compromised agent

Microsegmentation backed by zero trust principles gives each agent, model, and data store its own boundary. Strict API controls limit which tools and endpoints an agent can call. If an attacker hijacks one agent, the compromise stays inside that segment, and lateral movement across the corporate network stops.

The path forward: Innovate with confidence

Securing generative AI works best when security controls act as an invisible guardrail. Employees maintain productivity, and the organization keeps its data secure.

The Zscaler Zero Trust Exchange secures generative AI usage, gives security teams full inline visibility into AI traffic, and applies real-time DLP to every prompt. Zscaler Zero Trust Browser contains risky sessions. Microsegmentation and API control protect custom models and agents. Built-in compliance mapping helps organizations align with regulatory frameworks like the EU AI Act and NIST AI RMF.

With zero trust in place, every new AI model or agent enters an environment that already verifies identity and inspects content. Access stays limited to what each user or agent needs, and teams can scale AI initiatives without waiting for security reviews to catch up.

With Zscaler, organizations can say yes to generative AI with confidence. Request a custom product demo to learn more.