R43 — Insider AI Misuse
Engineer pasting source code into personal LLM chat or coding assistants; deliberate misuse of internal AI agents to extract data; prompt-history retention by personal accounts. Distinct from R09 (general insider) and R27 (shadow AI usage).
What is Insider AI Misuse?
Engineer pasting source code into personal LLM chat or coding assistants; deliberate misuse of internal AI agents to extract data; prompt-history retention by personal accounts. Distinct from R09 (general insider) and R27 (shadow AI usage). CISO Game tracks this as R43 in the live risk register, severity 7 (Major), category AI.
How does CISO Game model Insider AI Misuse?
Exposure for R43 runs from 0 to 100, recomputed live as you buy, cancel, or reassign products. How the exposure model works →
Real-world parallel
Insider AI misuse — an employee using their AI access to extract confidential data, generate compromising content, or accelerate exfiltration — is the AI-specific subset of R09. The detection problem is harder because LLM access patterns aren't well-modeled by legacy DLP. AI-output logging and anomaly detection on prompt content are still emerging.
How do security teams mitigate Insider AI Misuse?
The dominant subscore levers for this risk are:
- Detection subscore — weight 30%
- Prevention subscore — weight 20%
- Identity subscore — weight 20%
- Awareness subscore — weight 20%
Residual offset: +5 exposure points are structural — no product fully removes them. Real-world parallels: zero-day windows, vendor monoculture, regulator unpredictability.
Gated: only active when AI focus is enabled in Setup.
Which related risks should you also watch?
Risks with similar dominant subscores or shared category — addressing one often helps the others:
- R23 Prompt Injection / JailbreakingAI · severity 8
- R27 Shadow AI / Unsanctioned LLM UseAI · severity 7
- R31 Autonomous AI Agent MisuseAI · severity 8
- R47 AI Inventory GapAI · severity 7
Why does Insider AI Misuse matter to a CISO?
AI risk is the newest category in the register. Insider AI Misuse requires controls that are still maturing — model cards, AI red-teaming, AI-SPM, prompt-injection detection. CISO Game's AI focus toggle activates these.
How can you test your mitigation strategy?
Click Play CISO Game free to see R43 appear live in your risk register and watch each purchase move the exposure number in real time. No signup required.