In this month's "Strike a Nerve" update, I wanted to share a story that connects AI adoption, nation-state espionage, and the kind of risk that most small and mid-sized businesses do not think applies to them. It does.
The U.S. State Department issued a diplomatic cable warning American companies about intensifying efforts by China to use AI tools, specifically DeepSeek and similar platforms, to conduct corporate espionage and steal AI-related intellectual property. The warning came as AI adoption inside American businesses is accelerating rapidly. The more your team relies on AI tools for sensitive work, the more valuable that activity becomes as an intelligence target.
Here is what that means practically. When employees use AI platforms for work, they are often feeding those tools proprietary information. Product details. Client data. Internal processes. Financial projections. That information does not disappear after the session ends. It lives somewhere, on a server, in a training dataset, in a log file. And if the platform has ties to foreign adversaries or lax security practices, that information is potentially accessible to people it was never meant to reach.
Your business may not be a defense contractor or a research lab. But if you operate in manufacturing, healthcare, professional services, or any industry that handles sensitive client information, you have data worth taking. The tools your team uses every day determine how exposed that data is.
Three steps to take right now:
- Establish a clear policy on which AI tools employees are permitted to use for work and what information can be shared with them.
- Avoid using foreign-developed AI platforms for any work involving client data, financial information, or proprietary business processes.
- Make sure your IT environment includes monitoring for unusual data flows that could indicate information leaving your network through unexpected channels.
Do you have visibility into how AI tools are being used across your organization right now? Let us help you find out.
— Steve, "Strike a Nerve" Monthly Cyber Threat Update