The executives demanding cyber risk in dollar figures are also the ones pasting customer data into ChatGPT.

That’s the uncomfortable thread running through two reports landing this week. CYE is making the rounds telling boards to translate cybersecurity exposure into dollars, attack paths, and customer-data impact. TrustedTech’s Shadow AI in the Workplace report says 65% of senior decision-makers use unapproved AI tools, more than double the 31% rate for everyone else. They know the policy. They know the risk. They use the tools anyway.

Read those numbers together and the picture is clear. The same people asking for grown-up risk metrics are the heaviest contributors to the largest unmanaged data-leakage channel most organizations have ever had.

The Cybersecurity Risk Hierarchy Is Upside Down

Security programs were built on the assumption that risk concentration scales with privilege. The CFO has more sensitive data access than an intern, so the CFO gets more controls. That logic still holds for what employees do at the application layer. It stops holding for what they paste into an AI prompt.

A junior support engineer pasting a log snippet into a free chatbot is one kind of problem. A CRO pasting a customer churn analysis with named accounts and revenue figures into an unaccounted AI service is a different category entirely.

Both are shadow AI. Only one of them blows up the quarterly numbers if it leaks.

The TrustedTech data is what it is. The people most likely to handle deal lists, M&A drafts, board materials, customer rosters, and unreleased financials are the same people most likely to feed them to third-party models with unclear data handling, weak retention policies, and unknown training pipelines.

Dollars Are A Two-Edged Metric

CYE’s three-step financial translation framework is sensible. Map attack paths to crown-jewel assets. Quantify exposure in business terms. Communicate in language executives understand. Security leaders should absolutely be doing this.

The Verizon 2026 DBIR continues to show that the breach pattern most organizations care about, third-party data exposure, runs into real money fast. The DocketWise breach disclosed this week hit 143,000 people through a third-party partner repository holding names, addresses, Social Security numbers, financial data, and medical data. That isn’t an abstract control failure. That’s a dollar figure with a regulator attached.

Once you convert risk to dollars, though, you’ve handed the board a yardstick that points both ways.

If shadow AI use among senior decision-makers leads to a single material data leak, the dollar framing the board demanded is the same one the post-incident report will use against them. The conversation stops being “should we tighten this policy” and becomes “the executive team’s behavior caused this loss.” Boards generally do not like reading their own names in that sentence.

Translating cyber security exposure into dollars makes executive risk visible. Security teams should use that, deliberately.

How To Tighten The Top Of The Org Chart

Make the approved path easier than the unapproved one, and make the unapproved path visible enough that risk shows up before a breach does. Stricter policy alone won’t move the 65%.

• Stand up a sanctioned AI gateway fronted by SSO. Route approved model access through it. Log prompts at a sensitivity-tagged level so DLP can flag pasted PII, customer records, financials, or unreleased materials before they leave the boundary.
• Pull AI-tool domains out of allowed-by-default web filtering. Build first-seen domain alerts for every AI endpoint your egress already sees, and require an explicit approval gate. Threat detection has to extend to the prompt layer.
• Issue executive-tier AI access deliberately. Decision-makers want these tools. Give them a private workspace with retention controls, training-opt-out clauses, and logging your incident response team can actually read.
• Run the dollar translation the board asked for quarterly, and include shadow AI exposure in the same report. Map specific business assets to specific unapproved tools observed in your egress logs.
• Update your incident response playbook for an AI-vendor data subpoena. If a sanctioned model has been fed regulated data, know who to call at the vendor before you need them, not after.

Defense in depth still applies. Firewall and threat-protection controls were never designed to stop a CFO from logging into a personal browser session and pasting a spreadsheet, and brute-force account abuse is no longer the most expensive credential-related exfiltration channel a security team has to defend against. The modern equivalent is a board-level user calmly pasting customer data into a model with a privacy policy nobody read.

Security hardening has to start treating the executive laptop like the privileged endpoint it actually is. The board will get its dollar figures. Make sure those figures include what the people in the room are doing on their own machines.

Sources

• Turns out the C-suite loves shadow AI
• Boards want cyber risk in dollars, not CVE counts
• DocketWise Data Breach Impacts 143,000
• Lessons for organizations from the Verizon 2026 Data Breach Investigations Report