Incident

Marketing uploaded customer spreadsheet to unsanctioned AI tool — CASB high-risk alert

CybersecurityDifficulty · Medium

Retry in progress

You have 1 previous attempt for this scenario. Submitting again will create a new attempt and show a comparison against your most recent response.

Shadow IT SaaSDifficulty · mediumHigh asset

[CASB] High-risk SaaS upload — 4.7 MB to ai-summarizer.io

From: CASB <casb@acme-corp.local>
To: soc@acme-corp.com
Date: 2026-04-19 13:32 UTC

CASB flagged an upload from a corporate endpoint to ai-summarizer.io, an unsanctioned AI summarization service. User: jen.kim@acme-corp.com (Marketing Coordinator) Endpoint: JKIM-LT22 (corp-managed) Files: customer-list-q1.xlsx (3.1 MB), campaign-results-q1.xlsx (1.6 MB) Destination: https://ai-summarizer.io/upload (free tier, no SSO) Account: signed up using corporate email on the free tier ToS clause 4.2: "uploaded content may be used to train and improve the Service." Vendor risk score: HIGH (low brand reputation, 6-month-old domain, no SOC 2, retains content for 90 days). Other Marketing users have visited this domain (4 endpoints in last 14 days). Please respond. — CASB / Cloud Security

Evidence

CASB session log + endpoint browser history

# CASB session (jen.kim@acme-corp.com → ai-summarizer.io)
13:18:04  GET   https://ai-summarizer.io/                     200
13:18:51  POST  https://ai-summarizer.io/api/signup            201   (free tier)
13:19:30  POST  https://ai-summarizer.io/api/upload            200   file=customer-list-q1.xlsx (3.1 MB)
13:20:12  POST  https://ai-summarizer.io/api/upload            200   file=campaign-results-q1.xlsx (1.6 MB)
13:20:48  POST  https://ai-summarizer.io/api/summarize         200

# Spreadsheet content type (DLP classifier)
customer-list-q1.xlsx     → contains: customer email + phone + segment + LTV  (PII, ~14k rows)
campaign-results-q1.xlsx  → contains: campaign metrics, no direct PII

# Other marketing endpoints with traffic to this domain (last 14d)
JKIM-LT22, MROSS-LT09, AVO-LT14, PCHEN-LT07

# Vendor record (CASB risk catalog)
ai-summarizer.io  registered 2025-10-12 (privacy-protected registrar)
                  TLS: Let's Encrypt, no SSO, no SOC 2, no DPA available
                  ToS: trains on uploads unless on the paid Pro tier

Affected asset

Name: Marketing dept users + customer-list-q1.xlsx (PII)
Type: Shadow SaaS upload — customer PII to unvetted AI vendor
Owner: Marketing
Level: High

Guided practice

Fill in one key action per box

0/29 filled

Each box asks for one distinct action or finding in that area, and the order of the boxes within an area does not matter. Short phrases are enough. Cover every area at least once to unlock the full written response.

Attack understanding

Asset impact

Prioritization

Containment

Investigation

Recovery

Evidence preservation

Checking is rule-based and nothing here is stored.