September 2026 Cybersecurity Update | ODVI DTT – DTT IT Department

🤖 Think Before You Prompt: Safe and Smarter Use of AI at Work

From: John Lester Rosima, Assistant Manager — IT & Cybersecurity
Company: ODVI Group

Hello Team!

AI tools such as ChatGPT, Claude, Gemini, Copilot, and other AI assistants can help us write, summarize, organize ideas, create templates, and complete repetitive tasks faster.

But as AI becomes more connected to files, websites, email, cloud storage, and other work applications, we also need to be careful about what information AI can see.

AI is a helpful assistant—but it is not automatically a private notebook.

Before entering company information, always consider whether the tool, information, and intended use are appropriate and approved.

🚦 Use the AI Traffic-Light Guide

Before sharing work information with AI, identify whether it is Green, Yellow, or Red.

🟢 GREEN — Generally Safe

Usually acceptable when no confidential or personal information is included:

• General writing or grammar assistance
• Brainstorming ideas
• Creating generic templates and checklists
• Asking about publicly available information
• Learning how to perform a general task

Example:

“Create a general checklist for preparing a monthly department report.”

🟡 YELLOW — Stop and Check First

These may contain internal company information:

• Internal meeting notes
• Draft announcements
• Internal procedures
• Unpublished reports or presentations
• Project plans
• Screenshots from company systems
• Internal financial information
• Source code or technical configurations
• Employee, customer, or supplier information

Yellow means: Check first before uploading or sharing.

Whenever possible, remove unnecessary names, account numbers, confidential figures, and identifying details.

🔴 RED — Do Not Enter into Public or Unapproved AI Tools

Never enter:

• Passwords or MFA codes
• Recovery codes
• API keys or access tokens
• Bank or payment information
• Payroll or salary records
• Government IDs
• Customer or employee personal information
• Confidential contracts
• Legal or investigation records
• Vulnerability or security findings
• Private account credentials

DTT IT will never ask you to enter passwords, MFA codes, recovery codes, or access keys into an AI chatbot.

💡 Latest AI Practice: Give AI Only What It Needs

A useful principle when using AI is data minimization.

In simple terms:

Give AI enough information to help you—but not everything you know.

Before uploading a complete document, spreadsheet, email thread, or screenshot, ask:

“What information does AI actually need to complete this task?”

1. Ask for the Structure First

Instead of:

❌ “Here is our complete internal report. Improve it.”

Try:

✅ “Create a professional format for a monthly management report with accomplishments, issues, risks, and next actions.”

Then apply the format yourself.

2. Replace Real Information with Placeholders

Instead of:

❌ “Create a reply to Juan Dela Cruz regarding Account #123456 and his ₱250,000 balance.”

Try:

✅ “Create a professional reply to [Customer] regarding [Account] and an outstanding balance.”

Add the actual details yourself afterward.

3. Share Only the Relevant Part

If AI only needs one paragraph, do not upload the entire report.

If it only needs a table structure, do not provide the complete spreadsheet.

Less information shared means less information exposed.

⚠️ Recent AI Security Lesson: Be Careful with Browser Extensions

AI risk is not limited to what you intentionally type into a chatbot.

In January 2026, researchers identified malicious Chrome extensions impersonating an AI productivity tool. According to a Cloud Security Alliance research note, the extensions had more than 900,000 combined installations and were able to steal complete ChatGPT and DeepSeek conversation histories, including confidential business information, internal workflows, and proprietary code.

The lesson is simple:

A conversation may be safe inside an approved AI service but still become exposed through an unsafe browser extension or connected tool.

Before installing an AI browser extension or connecting AI to another application:

• Check whether the tool is approved
• Review the permissions it requests
• Avoid extensions that request unnecessary access
• Do not connect company accounts without approval
• Remove extensions or integrations you no longer use

Remember:

Do not only think about what you type into AI. Think about what the AI tool—or anything connected to it—can see.

Google also warned in April 2026 that indirect prompt injection is becoming an important security concern for AI agents. This can happen when an AI reads a webpage, email, or document containing hidden malicious instructions and then follows those instructions unintentionally.

🧠 Use AI to Support Your Thinking

AI can help you:

• Organize ideas
• Improve wording
• Create templates
• Summarize approved information
• Compare general approaches
• Identify questions you may have missed

But AI should not automatically make the decision for you.

Use AI to help you think—not to avoid thinking.

Using a more general prompt can also help you retain your own judgment instead of giving AI every detail and asking it to decide everything.

🧩 Try the Minimum Context Method

Step 1 — Ask generally

“Create a format for reporting a delayed IT project.”

Step 2 — Add only necessary context

“The project involves software deployment across several locations.”

Step 3 — Replace sensitive information

Use:

“[Business Unit]”
“[Vendor]”
“[Target Date]”

instead of actual confidential information.

Step 4 — Review and add real details yourself

You may discover that AI can help with most of the task without ever seeing the sensitive information.

Better prompting does not always mean giving AI more information. Sometimes the better prompt is the one that shares less.

⚠️ AI Still Needs Human Review

Modern AI can produce polished and useful answers, but it can still:

• Misunderstand context
• Use outdated information
• Make incorrect calculations
• Invent names, dates, sources, or links
• Provide inaccurate technical instructions
• Misinterpret policies or procedures

The important lesson is:

AI output still requires human judgment.

Before sending AI-generated work to a customer, manager, executive, or colleague, review the facts, assumptions, calculations, recommendations, and final wording.

Professional-looking does not always mean correct.

🎥 Watch & Learn: Better AI Prompting

Better Prompting for Work — OpenAI Academy

OpenAI released a short prompting guide in August 2026 covering how employees can write clearer prompts while considering:

• Approved AI tools
• Appropriate access
• Reliable information
• Human judgment
• When prompting is—and is not—the real problem

Watch: Better Prompting for Federal Work — OpenAI Academy

The same principle applies to our work:

Clear prompts need useful context—not every piece of information available.

OpenAI also recommends structuring prompts around the role, task, context, output, limits, and check, while keeping human verification part of the workflow.

✋ PAUSE Before You Prompt

Use PAUSE as your quick AI safety check.

P — Public?

Is the information already publicly available?

A — Approved?

Is the AI tool appropriate and approved for company work?

U — Use Less

Can you complete the task without sharing the entire document or real names?

S — Sensitive?

Does the information contain personal, financial, legal, operational, or security-related details?

E — Examine

Have you reviewed and verified the AI-generated answer?

When in doubt, PAUSE and ask DTT IT first.

🧠 Quick Knowledge Check

You want AI to analyze a spreadsheet containing employee names, salaries, attendance records, and performance ratings.

What should you do?

A. Upload the spreadsheet to any free AI website.
B. Rename the file before uploading.
C. Remove only the employee names.
D. Confirm whether the AI tool and intended use are approved before sharing the information.

✅ Correct Answer: D

Renaming the file does not protect its contents.

Even after removing names, salary, attendance, performance, and other information may still be confidential or identifiable.

🛡️ Remember the Three AI Safety Rules

1. Never share passwords, MFA codes, recovery codes, or access keys with AI.
2. Do not upload confidential company information to an unapproved AI tool.
3. Give AI only the information it needs, then review its output before using it.

AI can help us work faster and smarter, but confidentiality, human judgment, and accountability must remain with us.

John Lester Rosima
Assistant Manager, IT & Cybersecurity · ODVI
lprosima@oakdriveventures.com

🤖 USE AI SMARTLY. PROTECT COMPANY INFORMATION.

Cybersecurity is everyone’s responsibility.

Think before you prompt. Share only what is needed.