The two assumptions
Assume breach says the attacker is already inside. Assume Leaked says your data is already outside.
Assume breach
The attacker is already inside. The wall failed.
Assume Leaked
Your data is already outside. The wall held, and it did not matter.
Assume Leaked, a principle formulated by Alexandru Ciobanu, CEO of CUBE Enterprise, 2026. assumeleaked.com
Prior art: "assume leak" was used by Clutch Security in 2025 for secrets and non-human identities: API keys, tokens, service accounts. Assume Leaked applies the same instinct to all the confidential data your people put into AI tools; the difference is the scope and the three rules.
Why
About 75% of your company's confidential data is already inside a public AI model. Not stolen. Pasted, by your own people.
75% is my number, not a study's. Until you show me yours, mine stands. A ban does not stop the flow; it stops you seeing it.
Shares of data pasted into AI tools, by account type: LayerX, AI & SaaS Data Security Report, 2025.
- 47%of people using generative AI at work do it from a personal account. Netskope, 2026
- 40%of AI interactions contain sensitive data. Cyberhaven, 2026
- 21%of organisations have full visibility into what sensitive data reaches AI. Netwrix, 2026
The three rules
What is out does not come back. You can only make it worthless.
An official AI that beats the shadow one
Company sign-on, no training on your data, a log. If it is worse than the ChatGPT in someone's pocket, you lost on day one.
First sprint, in practice: read-only, one source such as the open-items list, with the user's own ERP rights. No second permission model. Yury Pakhomov, from the Sweden thread, 30 October 2026
Block the crown jewels, not everything
Credentials, source code, customer data, prices, personal data: stopped before they reach the prompt. Everything else stays open.
AI goes into onboarding and offboarding
The official account from day one. When someone leaves, every secret they touched is rotated the next morning.
The AI budget is the security budget. Not the other way round.
In thirty seconds
The principle, the contrast and the three rules, with no sound. Use it to open a meeting.
Seven questions to ask your CISO this week
Assume Leaked becomes a Monday-morning conversation, not a slogan.
The seven questions (PDF)
A short worksheet: seven questions that turn the principle into decisions about your data, your contracts, what leaves, and what you tell a client who asks.
In the conversation
The principle is being formulated in public, on LinkedIn: argued, corrected, extended by the people who read it. Read the threads, disagree in them.
From the comments
- "Access beats IQ." The approved tool wins on what it can read, not on model quality. Yury Pakhomov
- "Better says nothing about authorised." Culture, training and DLP are not optional; matching every alternative is not the aim of governance. Angelique Dawnbringer
- "What makes Microsoft more trustworthy?" Nothing. It is paperwork, not trust: the approved tool is the one already under contract. Svend Videbaek
- Can we prove which data was exposed, which agents accessed it, and whether their permissions were revoked? Saliha Abid
- Who has the authority to switch an AI tool off at 2 a.m., and have they ever been asked to? Mada Petrea
Use the term
Use it in your policy, your talk, your article. Keep the wording, credit the source, link this page. Tell me where it went and I link back from here.
On LinkedIn: #AssumeLeaked
Questions
- What is Assume Leaked?
- Assume Leaked: build as if your confidential data is already outside, in models and accounts you do not control, and make the leak not matter instead of trying to prevent it. It was formulated by Alexandru Ciobanu, CEO of CUBE Enterprise, in 2026. First public use: September 2026 (talk), 15 October 2026 (LinkedIn).
- How is Assume Leaked different from assume breach?
- Assume breach says the attacker is already inside. Assume Leaked says your data is already outside. Assume breach is about containing an intruder; Assume Leaked is about making a copy of your data worthless once it sits in a model or an account you do not control.
- Is Assume Leaked the same as Clutch Security's "assume leak"?
- No, but it is related. Clutch Security used "assume leak" in 2025 for secrets and non-human identities: API keys, tokens, service accounts. Assume Leaked applies the same instinct to all the confidential data your people put into AI tools, and adds three rules for it. Clutch Security's work is linked on this page as prior art.
- What are the three rules of Assume Leaked?
- One: an official AI that beats the shadow one. Two: block the crown jewels, not everything. Three: AI goes into onboarding and offboarding.
- How do I cite Assume Leaked?
- Assume Leaked, a principle formulated by Alexandru Ciobanu, CEO of CUBE Enterprise, 2026. assumeleaked.com. Keep the wording, credit the source, link this page.
Talks and press
The talk
Assume Leaked: what to do once you stop pretending. Twenty or forty-five minutes. The room leaves with the three rules, the seven questions, and one number to argue about.
For CIO and CISO audiences, security conferences, and leadership offsites. In English or Romanian.
Press
Interviews and contributed pieces: write to alex@cube-enterprise.com.
Every number on this page has a named source. The one estimate, 75%, is mine and is labelled as such.
Download the press kitInterviews and articles
What's next
Assume Leaked Report 2026
A survey of employees at large companies in Germany and the UK on what actually goes into AI tools, who keeps the account after they leave, and whether a ban changes anything. Published in December. Follow on LinkedIn to get it first.
Sources
- LayerX, AI & SaaS Data Security Report 2025: 77% of AI users paste data into prompts; 82% of pasting comes from unmanaged accounts; generative AI is 32% of corporate-to-personal data flow.
- Cyberhaven, AI Adoption & Risk Report 2026: 39.7% of AI interactions contain sensitive data; one sensitive input every three days per employee.
- Netskope, Cloud and Threat Report 2026: 47% of generative AI users use personal accounts; source code, IP and credentials reach AI tools.
- Netwrix, Data & Identity Security Report 2026: 21% have full visibility into sensitive data reaching AI; 31% can fully block it.
- IBM, Cost of a Data Breach Report 2026: shadow AI from 20% to 43% of incidents; 68% of breached companies had no AI governance.
- Vanta, data from 15,000+ companies, 2024–2026: 70% have shadow AI; employees reinstall tools IT revokes.
- Samsung, 2023: generative AI restricted after employees put source code into ChatGPT.
- TechRadar, 26 October 2026: the Swedish government blocks ChatGPT and Claude for officials; Copilot kept under tighter controls.
75% is my estimate. Every other number above comes from the reports listed.
Author
Alexandru Ciobanu is CEO of CUBE Enterprise, a consortium of eight Romanian technology companies with 2,500+ specialists working for enterprises in Germany, the Nordics, the UK and the US, and Chief Growth Officer of WE AS WEB. Before that, eight years on the delivery side: HARMAN, Tremend, ALTEN. Sixteen years in competitive judo, six on Romania's national squad.
LinkedIncube-enterprise.comalex@cube-enterprise.com
First public use: September 2026 (talk), 15 October 2026 (LinkedIn). This page is the canonical definition; later wording changes are listed here with their date.