Zscaler data reveals 93% surge in enterprise AI data transfers

Zscaler’s ThreatLabz 2026 AI Security Report highlights a critical visibility gap for managed service providers and enterprise security teams. According to The Next Web, rapid AI adoption has created complex stacks that include developer tools, agents, and embedded features, often bypassing traditional procurement and security reviews. This unmanaged expansion makes it difficult for organizations to map their true AI footprint or monitor where sensitive data is flowing.

By the numbers

• AI/ML transactions climbed 83% year-over-year during 2025, based on nearly a trillion transactions from 9,000 organizations.
• The number of applications generating this traffic nearly quadrupled, reaching more than 3,400 unique platforms.
• Data transfers to AI/ML applications increased by 93% in 2025, according to Zscaler’s analysis.

What the figures mean

The data indicates that AI usage is expanding beyond sanctioned copilots into discreet channels. Zscaler found that AI features are increasingly built into existing software and connected via APIs to internal systems. Additionally, autonomous agents are handling tasks previously managed by humans, with Salesforce reporting that customers doubled their agentic AI workforce between February 2025 and April 2026. This growth occurs in areas security teams are not actively monitoring.

The report identified 410 million data loss prevention policy violations tied specifically to ChatGPT in 2025. These incidents included attempts to share sensitive information such as Social Security numbers, source code, and medical records. That suggests security teams are struggling to secure an AI stack they cannot fully see, leaving enterprises exposed to unclassified data exfiltration risks through unmonitored applications and embedded services.

What should you do?

Security leaders should immediately audit their environments to identify all AI tools currently in use, including those embedded in existing software or accessed via APIs. Teams usually need to verify whether current data loss prevention policies cover these new channels and if they are correctly classifying AI traffic. It is essential to determine who has access to these tools and where enterprise data is flowing. Organizations should engage with their managed service providers to ensure monitoring capabilities extend to these discreet adoption points.

Operational impact

Organizations must determine which internal teams are responsible for tracking AI usage across all platforms. Security operations centers should evaluate whether their current monitoring tools can detect AI traffic within legacy applications. Procurement teams need to review vendor contracts to ensure AI features are covered by existing security agreements. Leadership should establish clear guidelines for employee use of external AI services to reduce unauthorized data exposure.

What to do and how to stay safe: Zscaler

• Inventory all AI applications and embedded features currently in use across the organization.
• Review data loss prevention logs to identify attempts to send sensitive data to AI platforms.
• Verify that security monitoring tools are configured to detect traffic from autonomous agents.
• Consult with managed service providers to enhance visibility into unmanaged AI channels.

Step-by-step guide: Shadow AI Explained: 8 Questions Answered for Secure Operations

General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much did AI traffic grow in 2025?

AI/ML transactions climbed 83% year-over-year, according to Zscaler’s analysis of nearly a trillion transactions.

What types of data were involved in DLP violations?

The report noted attempts to share Social Security numbers, source code, and medical records via ChatGPT.

How many applications are generating AI traffic?

The number of applications generating this traffic nearly quadrupled to more than 3,400 platforms.