Employers are struggling to figure out how to fold ChatGPT into their workflows without risking the security of their corporate secrets, customer information and intellectual property.

The big picture: Engineers and programmers across many industries have found great utility in refining code or double-checking their work by running it through ChatGPT.

• However, there has not been a lot of transparency around the collection of that data, where it goes or how it could potentially be used.

Driving the news: Using ChatGPT in corporate settings is about to get a lot easier after Salesforce unveiled plans this week to integrate the large language model chatbot into Slack.

• Salesforce isn't alone. Several technology companies, including Snap, have been racing to integrate generative AI into their consumer-facing products and tools.

What's happening: Increasingly, employers are getting nervous about how employees might use ChatGPT at work.

• Walmart and Amazon have both reportedly warned employees not to share confidential information in the chatbot.
• An Amazon corporate lawyer told employees the company has already seen instances of ChatGPT responses that are similar to internal Amazon data, according to Insider.
• JPMorgan Chase & Co. and Verizon have reportedly blocked employee access to the online tool.
• Meanwhile, OpenAI changed its terms of service last week so its models no longer use user inputs by default to train amid growing concerns about privacy risks.

By the numbers: 2.3% of workers have put confidential company information into ChatGPT, according to a recent report from Cyberhaven.

• A Fishbowl survey last month found that nearly 70% of employees who are using ChatGPT at work haven't told their bosses about it.

The intrigue: Employees are finding ways to evade corporate network bans blocking access to ChatGPT, Cyberhaven CEO Howard Ting told Axios.

• Ting said some companies believed employees had no access to the chatbot before Cyberhaven told them otherwise. "Users can use a proxy to get around a lot of those network-based security tools," he said.

Between the lines: The first step companies need to take to mitigate the security risks is to get visibility into how employees are actually using ChatGPT, Ting said.

• Business leaders will also need to place controls on whatever generative AI tools they end up using to prevent them from sharing highly sensitive corporate data with employees who aren't cleared to see it, Arvind Jain, CEO of workplace search company Glean, told Axios.

Meanwhile, companies aren't planning to completely eradicate ChatGPT from their systems. Instead, some have started seeking out custom generative AI solutions that come with more controls than ChatGPT.

• Peter van der Putten, director of the AI lab at Pegasystems, told Axios his firm is developing several new features following consumer demand for specific generative AI tools to help them craft advertising copy and in other cases.
• "From a cybersecurity point of view, you have more control if it's a specific use case, and it's not a freeform prompt," van der Putten said.

Yes, but: Placing total control on how generative AI learns and grows from customer inputs is an impossible task, Jain said.

• "These generative models, they're a black box, and no human can actually explain the algorithms behind the scenes," Jain said "They're uncontrollable in some sense."

A hacker who uses the pseudonym "Denfur" is selling a database they claim includes stolen sensitive data from at least 55,000 customers of D.C.'s health insurance marketplace, including members of Congress and their staffs.

Driving the news: Congressional leaders started warning lawmakers on Wednesday about the breach at DC Health Link and suggested they freeze their credit while an investigation continues.

• DC Health Link, which confirmed the breach and dark web leaks in a statement, helps all city residents purchase health insurance, not just members of Congress.

What's happening: Researchers at Check Point Research told Axios Thursday that a malicious hacker had posted the database for sale on the "biggest English-speaking dark web hacking forum." The member claims the database includes sensitive data from thousands of customers, including Social Security numbers, birthdates and home addresses.

• Denfur is now selling the stolen database for just "a few dollars," researchers noted. Denfur signed off the post with "Glory to Russia!"
• CyberScoop reports that a sample of the stolen data includes information about former defense officials and lobbyists, and the Associated Press reported it was able to authenticate data belonging to two victims in the set.
• Axios has seen the dark web post, which was still live as of Friday morning.

Why it matters: Malicious actors often rely on stolen personal data to commit identity theft and hijack online accounts, and it's rare for them to be able to collect verifiable information from high-ranking U.S. officials.

What they're saying: "Such precious information will have high demand in the dark web and, in the wrong hands, can lead to significant downstream consequences," Sergey Shykevich, threat intelligence manager at Check Point Research, said in a statement.

Zoom out: The breach comes as lawmakers focus more on cybersecurity issues plaguing the health care sector.

• Senate Intelligence Chair Mark Warner (D-Va.) released a policy paper last fall with proposals to improve cybersecurity in the sector.
• And the Senate Homeland Security Committee is hosting a hearing on this topic next week.

Yes, but: DC Health Link and the FBI are still investigating the precise scope of the data breach, and it's yet to be confirmed how many people have actually been affected.

The Pentagon is attempting to better compete with Silicon Valley for civilian cyber talent in a newly released workforce strategy.

Driving the news: The Department of Defense released a cyber workforce strategy Thursday that details training programs, recruitment process changes and apprenticeship programs it hopes to pursue between 2023 and 2027.

Why it matters: The federal government, including the Pentagon, has struggled to compete with private-sector cybersecurity roles that can offer higher salaries and more workplace flexibility.

• Currently, the DoD has a 25% vacancy rate in its cyber workforce across military and civilian roles, Mark Gorak, principal director for resources and analysis in the DoD's Office of the Chief Information Officer, told reporters during a press briefing.

What they're saying: "The DoD and the federal government has a very difficult time competing on salary, so we have to compete on mission and other tangibles to the department — leadership, organizational culture [and] mission is the key there," Gorak said.

The big picture: The Pentagon is releasing its cyber workforce strategy as the White House's Office of the National Cyber Director continues work on a wide-reaching cyber workforce strategy of its own.

Details: The Pentagon's strategy is broken down into four goals: identify what skills are needed, recruit more needed talent, develop a cyber-minded workplace culture and retain the talent it has.

• As part of that strategy, the DoD plans to create a new talent management system and implement regular assessments to figure out what additional training and skill sets are needed.
• To foster talent that's already in the Pentagon, the department also wants to establish a development fund for employee trainings.

Go deeper

@ D.C.

👀 Rep. Darin LaHood (R-Ill.) is alleging the FBI improperly searched a Foreign Intelligence Surveillance Act database to determine if he had ties to foreign intelligence. (Fox News)

💸 President Joe Biden's fiscal 2024 budget proposal is pushing for millions in additional investments in the country's cybersecurity defenses and crime-fighting capabilities. (CyberScoop)

🏛 FBI Director Christopher Wray testified that the Chinese government could control millions of Americans' TikTok data if ByteDance U.S. were ever forced to hand over data. (Axios)

@ Industry

💰 CrowdStrike reported better-than-expected quarterly earnings Thursday and claimed to have onboarded a new Fortune 50 financial institution and a multinational fintech company as customers. (Cybersecurity Dive)

✈️ The Transportation Security Administration released new cybersecurity requirements for the aviation sector. (SecurityWeek)

🔎 A conservative Catholic nonprofit spent millions of dollars on mobile app tracking data that identified priests using queer dating apps. (Washington Post)

@ Hackers and hacks

📚 PeopleGrove, a social platform for higher education institutions, confirmed it's investigating a recent security lapse that exposed users' personal information. (TechCrunch)

🍎 Ransomware gang Medusa published a Vimeo video detailing its access to personal staff and student data following an attack on Minneapolis Public Schools. (Axios)

It's certainly been a long few weeks in cyber world — why not have a good laugh to commiserate?