Rate how safely the tools handled sensitive data, with no exposure through outputs, logs, or connected systems

The mean rating was 4.5 and the median 4.0 (n = 800 respondents). Ratings of 3 or below, the distressed range, made up 32.38% of the answers. The rating was associated with all four study measures. Higher ratings came with less cancellation (r = −0.67, 95% CI −0.75 to −0.57, p < 0.001, n = 150 engagements), higher customer satisfaction among active engagements (r = 0.66, 95% CI 0.53 to 0.76, p < 0.001, n = 94 engagements), a higher engagement indicator mean computed without the indicator (r = 0.87, 95% CI 0.83 to 0.91, p < 0.001, n = 150 engagements) and lower intent to leave (r = −0.66, cluster bootstrap 95% CI −0.71 to −0.59, p < 0.001 with standard errors clustered by engagement, n = 751 respondents). After Holm correction, ratings differed by engagement status and lifecycle stage (Welch F 48.98, Holm p < 0.001, omega squared 0.434), respondent role (Welch F 8.88, Holm p = 0.002, omega squared 0.018) and vendor type (Welch F 5.07, Holm p = 0.001, omega squared 0.026).

Of the 28 written responses, all but one from C177, the comment field on the AI tools, 22 were negative and 6 positive. Respondents described sensitive data written into logs that others could read and surfacing in outputs where it did not belong, found by people rather than by the guardrails. Teams responded by stripping sensitive fields before anything reached the tool. A more negative written score came with higher intent to leave.

Ratings of 3 or below, the distressed range, accounted for 259 of the 800 answers (32.38%). The engagement mean fell in the distressed range in 37 of 150 engagements.

The primary responses numbered 27, all written in answer to C177, “Add any comments on the agentic AI tools that the ratings in this section do not capture.” The remaining 1 responses, 3.57% of the total, were secondary and came from 1 other questions. Respondents who wrote both a primary and a secondary response numbered 0. Negative responses made up 77.78% of primary responses (21 of 27) and 1 of the 1 secondary responses.

Eight responses described sensitive data written into logs, chat logs or trace files that others could read: account numbers in full and unmasked in a folder half the floor could open, salary lines and staff cost lines in readable logs, card numbers and merchant names found in a log file with no one able to say for how long. Ten responses described sensitive data surfacing where it did not belong. Real investor account numbers were written into a test data file, an employee's home address went into a public ticket note for a laptop swap, payroll details appeared in a transcript visible to the wrong queue, and another employee's benefits line appeared in an offboarding summary.

Four responses said a person caught the exposure rather than the guardrails, one in those words. Four responses described masking or stripping sensitive fields before anything reached the tool, in some cases because no one could say where the logs were kept or who could read them, with identifiers restored by hand afterwards. One respondent reported two payroll incidents, neither closed before the account ended, and logs retained for seven days despite a request to change it. The single response to C055 said data-sharing incidents were logged as generic access exceptions, so that they stayed off the incident dashboard shown to the financial institution.

The six positive responses described data handling as clean, with no record leaked over periods of up to six months, and placed their concerns in consistency, logging and false completion. One of these respondents kept sensitive data away from the tool altogether.

Of the 28 responses, 22 (78.57%, 95% CI 62.96% to 92.86%) were negative and 2 (7.14%) carried the strongest negative score of −10. Positive responses numbered 6 (21.43%), and no response was neutral. The mean written score was −2.9 (95% CI −4.7 to −0.7, n = 28 responses), and the median was −5.0.

Of the 28 responses, 28 came from respondents who also rated the indicator. Among them, the written score rose with the rating (Spearman rho 0.63, 95% CI 0.35 to 0.81, p < 0.001, n = 28 responses). The written responses corroborated the rating. Of the 22 negative responses with a rating, 18 (81.82%) came from respondents whose rating was in the distressed range.

Respondents who wrote about the indicator and gave a rating numbered 28, with a mean rating of 3.4. The 772 respondents who rated the indicator without writing about it had a mean of 4.6. The difference, −1.2 (95% CI −2.2 to −0.1), excluded zero. Ratings in the distressed range made up 67.86% of the ratings from respondents who wrote (19 of 28) and 31.09% of the ratings from respondents who did not (240 of 772).

The respondents who wrote came disproportionately from the distressed end of the scale. The written evidence therefore gives more weight to the respondents who rated the indicator worst.

Every figure in the segment tables is at respondent level. Segments with fewer than 30 respondents carry no interval. Segments with fewer than 10 report counts only.

Segment families recorded at engagement level were tested on engagement means. Respondent role and vendor type were tested on respondents. Where an expected count fell below 5, the test of the distressed share used Fisher's exact test for a two-by-two table, marked exact, or a Monte Carlo test, marked simulated. After Holm correction, ratings differed by engagement status and lifecycle stage (Welch F 48.98, Holm p < 0.001, omega squared 0.434). Active engagements in Build-Out rated highest (mean 5.6, n = 165 respondents) and canceled engagements lowest (mean 3.1, n = 303 respondents). Ratings also differed by respondent role (Welch F 8.88, Holm p = 0.002, omega squared 0.018). Portfolio directors rated highest (mean 5.3, n = 30 respondents) and individual contributors lowest (mean 4.4, n = 619 respondents). Ratings also differed by vendor type (Welch F 5.07, Holm p = 0.001, omega squared 0.026). Consulting firms rated highest (mean 5.1, n = 111 respondents) and BPO specialists lowest (mean 4.1, n = 184 respondents). Outsourcing model, institution type, process family and class of work showed no difference.

Written sentiment did not differ by engagement status and lifecycle stage across the 26 engagements with a written response (Kruskal-Wallis H 2.02, df 2, p = 0.364). Fewer than two groups held 10 or more responses, so the groups are reported as counts only: active engagements in Build-Out (1), active engagements in Transition/Cut-Over (6), active engagements in Production (6) and canceled engagements (15).

No test across respondent roles was run, because fewer than two roles had 30 or more written responses. Individual contributors wrote 20, engagement managers wrote 7 and portfolio directors wrote 1 responses, reported as counts only.

Cancellation rate is the share of engagements canceled by the study date, measured at engagement level (150 engagements, 56 canceled). Canceled engagements were rated after cancellation. The association is therefore a descriptive contrast and not a forecast of cancellation.

Across the study set, higher ratings came with less cancellation (r = −0.67, 95% CI −0.75 to −0.57, Holm p < 0.001, n = 150 engagements). The association held after Holm correction in fifteen of the 20 segment levels tested.

Customer satisfaction is the percentage recorded against each engagement. The primary estimate uses the 94 active engagements. A descriptive contrast uses all 150 engagements.

Across the active engagements, higher ratings came with higher customer satisfaction (r = 0.66, 95% CI 0.53 to 0.76, Holm p < 0.001, n = 94 engagements). The association held after Holm correction in thirteen of the 16 segment levels tested.

The engagement indicator mean is the mean of an engagement's ratings across the rated indicators, measured at engagement level (150 engagements). The indicator is one of the rated indicators. Each comparison therefore uses the mean recomputed without it.

Higher ratings came with a higher engagement indicator mean (r = 0.87, 95% CI 0.83 to 0.91, Holm p < 0.001, n = 150 engagements). The association held after Holm correction in twenty-four of the 24 segment levels tested.

Intent to leave is the answer to C019, “How likely are you to leave your current job in the next 12 months?”, rated 1 to 10. It is measured at respondent level on up to 798 respondents, with the engagement-level form reported alongside.

Respondents who gave higher ratings reported lower intent to leave (r = −0.66, 95% CI −0.69 to −0.61, Holm p < 0.001, n = 751 respondents). The association held after Holm correction in thirty-six of the 37 segment levels tested.

Two comparisons set the engagements with at least one negative response against all other engagements. Of the 129 other engagements, 123 had no written response addressing the indicator. These two comparisons therefore do not isolate written sentiment. Of the 21 engagements with a negative response, 12 (57.14%) were canceled, against 44 of the 129 other engagements (34.11%). The difference did not reach significance (Fisher exact p = 0.053). The comparison of customer satisfaction was not computed, because one of the two groups held too few active engagements.

Two correlations test written sentiment directly. Across the 27 engagements with a written response, the engagement mean written score was not associated with cancellation (point-biserial r −0.29, p = 0.137). Across 28 respondents, a more negative respondent mean written score came with higher intent to leave (Spearman rho −0.44, p = 0.018). Of the three comparisons, one reached significance at 0.05.

The four associations were compared in pairs on their engagement-level forms, each oriented so that a higher value is the better outcome, across the 150 engagements with all four measures. After Holm correction, five of the six pairs differed. The association with the engagement indicator mean was the strongest and the association with intent to leave the weakest. The associations with customer satisfaction and intent to leave did not differ (Holm p = 0.392).

Answers clustered within engagements (ICC 0.63). Clustering reduced the 800 respondent answers to the equivalent of about 214 independent answers. Respondent-level intervals therefore used the cluster bootstrap. Respondent-level tests of intent to leave used standard errors that allow for clustering by engagement.

No association was equivalent to zero. Each of the four differed from zero. The detection floor shown is the study floor at 150 engagements. Intent to leave was tested on its effective sample size.

Each change was computed before rounding and may differ by 0.01 from the difference between the two printed values.

All 22 checks held. A check holds when its test falls on the same side of 0.05 as the primary test. Where the primary test falls below 0.05, the check must also keep the sign of the primary correlation. The thin-base check removes the engagements in any level of outsourcing model or process family with fewer than 30 engagements. Institution type is not used for that check, because every one of its levels has fewer than 30 engagements.

Each of the four measures was computed from data the indicator does not contain. Each result is therefore a finding and not an arithmetic consequence. The indicator is one of the rated indicators, and the engagement indicator mean was recomputed without it. The correction changed r by 0.00, from 0.88 to 0.87.

Each deviation was computed before rounding and may differ by 0.01 from the difference between the two printed values.

The comparison covered 150 engagements. The indicator followed the study's typical pattern on all four measures, and no deviation held after Holm correction.

Among the 71 Part 2 indicators with 30 or more written responses, the indicator's share of negative responses, 78.57%, ranked 43rd from the highest, against a median of 80.82%. Its mean written score, −2.9, ranked 63rd from the most negative, against a median of −4.7.

The indicator most often present in the same responses was C157, “Rate the factual reliability of the AI tools' outputs on this engagement before any human review.”, in 5 of the 28 responses (17.86%). C164, “Rate how reliably the tools retained instructions and constraints given earlier in long tasks and sessions.” (5 responses), C176, “Rate the quality of the tools' logs, traces, and usage telemetry for detecting and diagnosing failures.” (5 responses), C159, “Rate the consistency of the tools' outputs when given the same input and instructions more than once.” (4 responses) and C163, “Rate how completely the tools kept each client's and each session's information isolated from every other client and session.” (4 responses) followed.

The most frequent theme was “Occurs every cycle or most days”, in 4 responses (14.29%). The second was “Comparison to a prior engagement”, in 3 responses.

About a third of all ratings of how safely the tools handled sensitive data fell in the distressed range (259 of 800 answers, 32.38%). The rating was associated with all four study measures, and every association held under each of the 22 robustness checks. Canceled engagements rated far below the three active stages (mean 3.1, n = 303 respondents).

The written evidence places the exposure in two channels: logs that retained sensitive fields with broad read access, and outputs that drew in data from the wrong record. In both, detection depended on a person reading closely. Respondents whose written responses were more negative reported higher intent to leave.

The evidence is the reported experience of the vendor's delivery teams, collected in a single cross-section. The associations reported here are not causal.

Tests by respondent role and by vendor type treated respondents as independent. The section on clustering reports how far clustering within engagements reduced the information in respondent-level figures.

Customer management executives gave 1 answers, a base of anecdote strength.

Shares of written sentiment are shares of responses and not of the study set of respondents. The written score takes five fixed values, so its mean and median are coarse. Responses clustered within engagements (28 responses on 27 engagements). Intervals for written sentiment therefore used a bootstrap by engagement.

The written responses number fewer than 30, so their shares and the written-sentiment tests rest on a small base.