BII RUNOFF
The A / P invoices uploaded to calculate CAM charges didn’ t just carry line-item totals. Vendor invoices routinely include bank account numbers and ACH routing details— the information vendors provide so they can get paid electronically.
The lease files didn’ t just carry renewal dates. They also carried tenant financial covenants, personal guarantees, contact information, and, in some cases, banking details tenants use for direct rent debits.
The risk to partners, vendors, and tenants does not overshadow the internal risk. A free AI tool now has data about your, yes, your vendors, partners, and tenants, and that data is now sitting somewhere a bad actor, or even a competitor, could get to and use against you. And when employees reach for these tools without oversight, shadow AI and shadow IT now compound each other, creating exposure that no single data security policy was designed to catch.
Could that damage your business? Cause you financial losses? Create a reputation management problem? You bet it could.
WHAT IS BII RUNOFF AND WHY CRE TEAMS ARE ESPECIALLY EXPOSED?
We call this pattern BII Runoff— the uncontrolled leakage of Business Identifiable Information into AI tools outside an organization’ s visibility or control. BII is the term federal agencies use for confidential commercial and financial information, the business equivalent of PII. It’ s not a new category of data. It’ s the same category that’ s always mattered. What’ s new is how easily it now flows out the door, one convenient upload at a time.
That’ s a different kind of risk than the one most AI-usage conversations focus on. It’ s not just“ Did we protect ourselves?” It’ s“ Did we just make someone else’ s problem for them, without their knowledge or consent?”
This isn’ t hypothetical or unique to real estate. In 2023, engineers at Samsung uploaded proprietary source code and a transcript of an internal meeting into ChatGPT while trying to solve routine problems faster, not realizing the tool could retain and train on what they’ d shared. The company restricted employee access within weeks.
Around the same time, JPMorgan Chase moved to limit employee ChatGPT use after staff had used it to summarize confidential client communications and trading data. Neither company’ s employees intended to leak anything. Both companies still ended up managing an incident.
The instinct is to write a data security policy: don’ t upload confidential information to AI tools. It doesn’ t hold, and everyone quietly knows it won’ t, because the tools are genuinely useful and genuinely fast, and a rule with no approved alternative just gets quietly ignored the next time someone’ s under deadline pressure.
What closes the gap is knowing what’ s already happening— which tools, which categories of information, whose data is involved, and then giving employees an approved way to get the same speed without the exposure. That’ s the difference between a policy that sits in a drawer and one that changes behavior.
BII Containment is how we do that: a full inventory of every AI tool in active use and what’ s been shared with it, an assessment of whether those tools retain or train on what they receive, an approved-tool policy that replaces the free-for-all with an actual decision, and plain-language employee guidance. All of this is followed by ongoing management, because new tools keep showing up and the exposure doesn’ t stop on its own.
We’ ve written before about the broader shift this sits inside— shadow AI operating alongside sanctioned AI inside most organizations. BII Runoff is the specific, CRE-relevant version of that pattern: the exact documents your finance and leasing teams handle every day are exactly the documents most likely to carry someone else’ s confidential information along with your own.
* Don’ t worry— the names have been changed to protect the, well, the guilty, in this case. Cybercriminals want their victims to think that these attacks are so advanced that there is nothing that can be done, but it’ s all part of the grift.
SECURITY IS FOUND IN THE FUNDAMENTALS
While leadership teams and company boards are chasing AI solutions that can“ meet the moment,” they’ re neglecting some of the most important elements of cybersecurity within their organizations. The focus should remain on employee training, and best practice adoption like, multi-factor authentication, and support from cybersecurity service providers.
We have tools to fight cybercriminals. When leaders prioritize data security, practical training, and strategic planning, they reduce their exposure to cyber risks. Yes, the threat landscape will continue to evolve, but we are not powerless in the face of these changes.
ProtectMyIT. com 9