Are your AI tools secure? New analysis reveals gaps among market leaders
Even 58% of large language models (LLM) users have tried two or more different LLMs, and worldwide companies are rapidly adopting them to streamline operations, create content, and assist employees. However, the new Cybernews Business Digital Index analysis reveals that many AI tools used in the workplace may not be as secure as businesses assume, posing risks to sensitive corporate data and brand reputation.
Image by Cybernews.
Even 58% of large language models (LLM) users have tried two or more different LLMs, and worldwide companies are rapidly adopting them to streamline operations, create content, and assist employees. However, the new Cybernews Business Digital Index analysis reveals that many AI tools used in the workplace may not be as secure as businesses assume, posing risks to sensitive corporate data and brand reputation.
Using only publicly available information, the Cybernews researchers analyzed the security of 10 popular LLM providers, including OpenAI, Claude, Perplexity, DeepSeek, and others.
The Business Digital Index uses custom scans, IoT search engines, IP, and domain name reputation databases to assess companies based on online security protocols.
According to analysis, 50% of the analyzed LLM providers achieved the highest A rating for cybersecurity. Meanwhile, two major players, OpenAI and 01.AI, received a D score, and Inflection AI scored an F. The average cybersecurity score across all analyzed providers stood at 88 out of 100.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
Five out of ten providers experienced data breaches
Harmonic’s analysis shows that 45.4% of sensitive data prompts are sent using personal accounts, bypassing official company channels entirely. This makes it harder for businesses to control security across platforms and exposes corporate data, often without companies even realizing it. It raises serious concerns about how AI tools are chosen and integrated.
This growing trend means organizations are increasingly exposed. Without strong cybersecurity practices, every LLM tool integrated into workflows can become a new entry point for attackers.
The Business Digital Index analysis shows that all LLM providers had SSL/TLS configuration vulnerabilities. If a company has issues with its SSL/TLS setup, it can expose sensitive data to interception, making its systems vulnerable to man-in-the-middle attacks and compromising user trust and data security.
According to index analysis, five out of ten providers recorded data breaches. Index analysis shows that OpenAI suffered the most breaches, with 1,140 incidents and a recent data leak just nine days before the analysis. Perplexity AI also experienced a breach 13 days earlier, with 190 corporate credentials compromised.
Credential leaks remain a pressing issue
Password reuse among employees further amplified risks, particularly at Perplexity AI, where, according to the index, 35% of employees reused breached passwords, and at EleutherAI, with 33%.
The report shows that system hosting vulnerabilities were another widespread weakness. Except for AI21 Labs and Anthropic, all other LLM providers faced notable hosting security issues. Perplexity AI and EleutherAI had nearly 40% of their systems cloud-hosted, making them more exposed to potential cyberattacks.
Regional comparison: U.S. vs China
The analysis also revealed clear regional differences. American AI providers had an average cybersecurity score of 87.5, outperforming Chinese companies, which averaged only 79.5. None of the Chinese providers rated above C, highlighting an important security gap.
The most striking example is the DeepSeek AI breach case, which showed how vulnerabilities in AI providers could open the door to broader corporate attacks. As adoption grows, threat actors shift their focus toward exploiting LLM-related weaknesses, from credential leaks to poor system hosting setups.
Meanwhile, the top three most secure LLM providers — AI21 Labs, Perplexity AI, and Anthropic — were based in the U.S. and Israel. However, Inflection AI, a U.S.-based firm, scored the lowest overall.
Research Methodology
Cybernews researchers analyzed 10 popular LLM providers. The report evaluates cybersecurity risk across seven key dimensions: software patching, web application security, email protection, system reputation, hosting infrastructure, SSL/TLS configuration, and data breach history. The report’s Methodology can be found here. It provides detailed information on how researchers conducted this analysis.
About Business Digital Index
The Business Digital Index (BDI) is designed to evaluate the cybersecurity health of organizations worldwide. It aims to help businesses by providing a clear, transparent, and independent assessment of their cybersecurity management, contributing to a more resilient digital future.
By leveraging data from reputable sources, such as IoT search engines, IP and domain reputation databases, and custom security scans, the BDI comprehensively assesses a company’s cybersecurity strength.
The index evaluates risks across seven critical areas: software updates, web security, email protection, system reputation, SSL/TLS setup, system hosting, and data breach history.