AnswersPublished17 sources
AI Blocklists Can Hide Risk: A Safer Approach for Singapore Firms
ThreatLabz observed nearly one trillion enterprise AI/ML transactions in 2025, with close to four in ten blocked. PagerDuty found that 66% of surveyed workers who had used AI for work had also used it despite believing their company did not allow it.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- ThreatLabz observed nearly one trillion enterprise AI/ML transactions in 2025, with close to four in ten blocked.
- PagerDuty found that 66% of surveyed workers who had used AI for work had also used it despite believing their company did not allow it.
- A safer middle path is to discover actual AI use, protect sensitive data wherever it resides, limit agents’ access and actions, and make approved tools practical to use.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: Why do AI blocklists give Singapore firms a false sense of security despite IMDA’s January 2026 Model AI Governance Framework for Agentic AI. Article summary: AI blocklists can confuse control over the corporate network with control over actual AI use: employees may move work to personal devices, while AI inside approved software remains accessible. IMDA’s January 2026 framewo. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
Blocklists can make AI activity less visible without resolving the reasons people use it. In 2025, ThreatLabz observed nearly one trillion enterprise AI and machine-learning transactions across Zscaler’s platform; commentary on the findings says organisations blocked close to four in ten, including widely used tools.1
6 The figures show substantial blocking in that platform’s traffic—not how much risk blocking removed, or how Singapore firms as a whole use AI.
For organisations in Singapore, the practical question is not only which apps to prohibit. It is how to govern AI use that may happen through personal devices, approved software with embedded assistants, or agents with access to business systems. IMDA’s Model AI Governance Framework for Agentic AI offers guidance on assessing risk and limiting agents’ access, autonomy and actions.26
Why blocklists alone fall short
A blocked request is not proof that AI use stopped
A network block can restrict a particular route to a service, but it cannot establish that an employee no longer has a work task they want AI to help with. In PagerDuty’s June 2026 survey, 66% of respondents who had used AI for work said they had used tools at work despite believing company policy did not allow it.38 The survey covered 1,250 office professionals at large organisations in Australia, Japan, the United Kingdom and the United States, so it is evidence of a broader workplace pattern—not a Singapore-specific rate.
41
The lesson is not that every block will be bypassed. It is that a prohibition by itself is an incomplete measure of employee behaviour and exposure.
AI is not limited to standalone apps
An organisation’s AI footprint can include approved business software with embedded assistants, integrations and agents, not just public chatbots. For each system, firms need to understand what information it can retrieve and what actions it can take. IMDA’s framework recommends bounding agent risks by considering factors such as access to sensitive data, autonomy, action scope and reversibility.20
26
That shifts the governance question from “Is this app on the list?” to “What can this AI access, disclose or change?”
Network visibility has limits
A worker might use a personal device or an unmonitored connection to get help with a work task. In that case, a corporate network block may not show the full path by which information is handled. Treat this as a scenario to plan for, rather than assuming network logs provide a complete record of AI use.
Likewise, an AI feature inside approved software still needs review of its permissions and data flows. Approval of the software does not automatically establish that every assistant or integration has appropriate access.
Some exposure has nothing to do with blocked AI apps
A Forcepoint post, citing Fortune’s reporting, described roughly 3,000 unpublished Anthropic assets becoming publicly accessible because of a content-management configuration issue.40 This is a reported example, not evidence about AI blocklists or Singapore firms. Its relevance is narrower: publication settings and permissions can create exposure independently of which AI applications an organisation permits.
A practical middle path for AI governance
Blanket prohibition and unrestricted access are not the only choices. A more useful approach combines visibility, data protection, bounded access and workable approved tools.
Build an inventory of actual AI use. Track approved tools, embedded features, integrations and agents. Combine technical discovery with clear ways for employees to disclose new uses. Treat network data as one source of visibility, not a complete account of every workflow.
Start protection with the most sensitive data. Identify high-risk repositories and review who—and what systems—can access them. Apply safeguards to the data wherever it is stored or used, rather than relying only on lists of application names.
Set and test boundaries for approved AI. Review what an assistant can retrieve, send and change. Limit access to what the task requires, and use human approval for consequential or difficult-to-reverse actions. These measures align with IMDA’s guidance to assess agent risks and constrain their scope, autonomy and access.
20
Make the approved route useful. Offer tools and approval processes that let people do legitimate work without resorting to unapproved alternatives. Measure whether tasks can be completed safely, not only how many requests a blocklist denies.
Blocklists can be one control, but they are not a reliable proxy for reduced risk. Better governance makes real AI use more visible, protects sensitive information wherever it moves, and limits what AI systems are able to do.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "AI Blocklists Can Hide Risk: A Safer Approach for Singapore Firms"?
ThreatLabz observed nearly one trillion enterprise AI/ML transactions in 2025, with close to four in ten blocked.
What are the key points to validate first?
ThreatLabz observed nearly one trillion enterprise AI/ML transactions in 2025, with close to four in ten blocked. PagerDuty found that 66% of surveyed workers who had used AI for work had also used it despite believing their company did not allow it.
What should I do next in practice?
A safer middle path is to discover actual AI use, protect sensitive data wherever it resides, limit agents’ access and actions, and make approved tools practical to use.