DeepSeek’s Deep Risks: What You Need to Know

Jan 29, 2025

With great innovation comes significant responsibility—and, unfortunately, substantial risk, if you’re not careful.

Sarah W. Frazier

DeepSeek’s Deep Risks: What You Need to Know

This webinar will cover:

With great innovation comes significant responsibility—and, unfortunately, substantial risk, if you’re not careful. One of the newest players in the generative AI space, DeepSeek, developed and hosted in China, has garnered attention and raised significant concerns that every cybersecurity professional should be aware of. Get the highlights in this video overview:

‍

Launched on January 20, 2025, DeepSeek has seen adoption rates rivaling OpenAI’s ChatGPT. To put DeepSeek’s rapid adoption into perspective, we only need to look at ChatGPT’s explosive growth. Within months of launch, ChatGPT grew from 1 million users to over 180 million. If DeepSeek grows at the same pace, security teams need to act quickly to reduce risks before the tool becomes widely used and embedded into employee workflows.

DeepSeek Security Concerns

While users are intrigued by its potential, the cracks in DeepSeek’s foundation are already showing. Developed with only $6 million in funding, DeepSeek’s infrastructure is regarded as far more vulnerable to cyber threats than its more established counterparts. Red teams have uncovered security flaws, and registrations were suspended days after its launch due to large-scale malicious cyber attacks—a troubling sign for any technology handling sensitive data.

Service Unavailability Message from DeepSeek

Dissecting DeepSeek’s Privacy Policy

DeepSeek’s privacy policy also gives cybersecurity leaders cause for concern. The data collected by the platform is extensive, including:

• Text and audio inputs
• Uploaded files
• Chat history
• Device model and operating system details
• Keystroke patterns and rhythms
• IP addresses
• Any personal information shared with the app

Unlike OpenAI, users cannot opt out of data sharing. Additionally, the policy explicitly grants DeepSeek rights to the information, which is stored on servers in The People’s Republic of China. This means the data is subject to Chinese laws, which allow for government access. In other words—you lose control of sensitive information, and any disputes regarding your data must be litigated in Chinese courts. For organizations in regulated industries, this creates compliance questions, not to mention the potential for breaches in an environment where you have no control.

National Concerns About Chinese Technologies

In the US, cybersecurity remains a national priority. China has been named the most active and persistent cyber threat in the country by the recent Executive Order issued by Former President Biden. This order highlights the threats posed by Chinese cyber operations to critical infrastructure, private businesses, and government systems. DeepSeek’s loose security and data-sharing practices align uncomfortably with these broader concerns, potentially exposing American organizations to espionage, intellectual property theft, and a host of breach risks.

Grip Mitigates DeepSeek Risks

The risks posed by DeepSeek are real, but organizations are not powerless. Here’s how you can mitigate the threat:

1. Monitor Employee Use of AI Tools: Generative AI tools are easy to access, and employees often adopt them without IT’s knowledge. Without visibility, it’s impossible to manage risk. Grip’s SaaS Security Control Plane already detects newly added applications. Additionally, a dedicated alert for DeepSeek has been added.

‍

Grip SSCP DeepSeek Alert and Risk Assessment

2. Secure Accounts: Know which employees are using DeepSeek and identify permissions (OAuth scopes) that may have been granted. Takeover or lock accounts for users who should not be using this or other generative AI apps. Again, the SaaS Security Control Plane provides unparalleled visibility,risk prioritization, and mitigation.

3. Educate Employees: Employees need to understand the risks of using tools like DeepSeek, especially when handling sensitive or proprietary data. Automatically notify employees to inform them of data and compliance risks and ask them to reaffirm that they know and understand the company’s policies.

Grip Closes Your Security Gaps

DeepSeek may be the newest contender in generative AI, but it’s far from being secure. With data privacy concerns, political biases, and a lack of compliance safeguards, it represents a clear and present risk to organizations worldwide. Combine this with the backdrop of escalating cyber threats from China, and the urgency becomes clear: take action now to protect your organization before vulnerabilities are exploited.

The accessibility of AI and SaaS applications has made it incredibly easy for employees to sign up and start using new tools—often without IT’s knowledge or oversight. A simple email registration is all it takes to introduce a high-risk app into your environment. Without visibility into what’s being used and by whom, security risks multiply. Sensitive company data can be unknowingly exposed, compliance violations can go unnoticed, and cybercriminals can exploit weak entry points. This isn’t just a hypothetical concern.

DeepSeek has already surfaced in 21% of Grip customer environments in just a few days.

The era of generative AI is here, but security must remain a top priority. Stay informed, stay vigilant, and take steps to ensure you’re fully aware of what’s happening in your SaaS environment. AI and SaaS tools can drive incredible innovation, but without visibility and control, they can also introduce serious vulnerabilities. At Grip, we empower companies to harness the full power of AI and SaaS confidently, knowing they have the security in place to do so safely.

To find out if employees in your company are using DeepSeek, or to do a generative AI risk assessment, book time with our team.

FAQs About DeepSeek Risks

What makes DeepSeek security different from other AI tools like ChatGPT?

DeepSeek is a generative AI platform developed in China, and while it offers similar capabilities to ChatGPT, there are significant concerns regarding data privacy, political biases, and security vulnerabilities. Unlike OpenAI, DeepSeek does not allow users to opt out of data sharing, and all information is stored on servers in China, raising compliance and cybersecurity concerns.

Why is DeepSeek a security risk for organizations?

DeepSeek collects a broad range of user data, including chat history, uploaded files, IP addresses, keystroke patterns, and more. Since this data is stored in China and may be shared to comply with local laws, there’s a heightened risk of data exposure, espionage, and non-compliance with cybersecurity standards. Additionally, DeepSeek was built with limited funding and has already suffered large-scale cyberattacks, making it more vulnerable than established AI platforms.

How can employees introduce DeepSeek into a company without IT knowing?

Like many SaaS and AI tools, DeepSeek is easily accessible—employees can sign up in seconds with an email or Google credentials. Without visibility into SaaS usage, security teams may not realize that employees are using high-risk AI tools until sensitive data has already been shared. This is why real-time monitoring and alerts, like those offered in Grip’s SaaS Security Control Plane, are critical for security teams.

How does Grip help mitigate the risks from DeepSeek?

Grip delivers unparalled visibility into newly adopted applications, identifying which employees are using them and assessing their security impact. By assigning risk scores based on asset exposure, usage patterns, and governance controls, Grip enables security teams to quickly evaluate threats and take proactive steps to secure data, enforce policies, or even prevent unauthorized AI tool usage.

In this webinar: