Mapping data exposure across AI tools

The pattern

Staff use several AI tools, each with different data. A few tool and data pairs often carry most of the exposure.

Question: Where is our business data going into AI tools?
Lane: Data loss
Basis: Vendor incident reports and standard practice

What METRIS does

Classify prompts and uploads by data type with an automated detector, on a sample
Compare use against the policy for each tool and data type
Rank tool and data pairs by weighted exposure and fix the top few first

Policy violations per 1,000 prompts

Simulation study · synthetic data

Each cell counts prompts that put a data type into a tool where policy says never. Darker means more. Green cells are allowed uses.

Method

exposure(tool, type) = violations(tool, type) × weight(type) weights: health or ID 8, customer 5, staff 5, contracts 3, pricing 1

Tools: 6
Data types: 5
Prompts: 10,700 in a month
Violation rates: 0.2% to 6% per prompt, by pair

A data map with weights turns a vague worry into a ranked list. The ranking, not the total, tells a small business where to act.

Where the exposure concentrates

Simulation study · synthetic data

Three of 21 risky pairs account for 62.4% of weighted exposure. Fixing those three first does most of the work. The rates are illustrative inputs.

Reproducibility

Prompt counts fixed by tool; violations binomial by pair. Random seed 20261013; Python with NumPy 2.5.3 and SciPy.

Sources

This pattern is not based on any single record. Its figures come from the model stated above.

Study design and analysis: Suneeta Modekurty, SANJEEVANI AI

A statistical study of a pattern, not of any event. It identifies no organization or person. Simulated figures use synthetic data; published figures are industry-wide.