AI-enabled data protection still leaves identity and session risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on CrowdStrike's blog post: AI-enabled data protection improves detection and policy handling, but leaves a critical gap in identity and session governance that determines whether data can actually move.

Why it matters: IAM, NHI, and security teams need to treat data protection as an identity problem as much as a content problem, especially where stolen credentials and active sessions enable exfiltration.

Context

Data protection tools often focus on content, but content alone does not explain who can move data, from where, and under what session conditions. That gap becomes sharper when organizations rely on SaaS, cloud storage, and hybrid work patterns, because access and activity are mediated by identities and sessions rather than by files in isolation.

CrowdStrike’s analysis frames the issue as an operational one as much as a detection one. Even when policy engines and analytics improve, organisations still struggle to control the identity layer that governs active access, especially when infostealers and session theft can turn legitimate access into data loss.

The article’s core point is that modern data protection cannot stop at classification and egress rules. It has to account for the authentication state, session trust, and privilege context that determine whether a user or compromised endpoint can move sensitive information at all.

Key questions

Q: What breaks when data protection tools ignore session context?

A: Controls that only inspect content miss the trust state that makes an access path dangerous. A user can appear authorised while a stolen browser session or cloud token is actually driving the transfer, so the policy engine sees normal behaviour instead of misuse. That is why content-first controls often generate noise while still leaving real exfiltration paths open.

Q: Why do infostealers create data loss risk even without ransomware?

A: Infostealers matter because they steal the authentication context that lets an attacker act as a legitimate user inside SaaS or cloud workflows. The risk is not only malware execution. It is the reuse of valid identity state to move data through approved applications, which often bypasses controls built only for malicious binaries.

Q: How can organisations tell whether data protection is actually working?

A: Look for fewer high-risk access paths, better alignment between privilege and task, and cleaner separation between normal business use and bulk or administrative movement. If privileged identities still reach more sensitive data than they need, the programme is still compensating after exposure instead of preventing it.

Q: Should organisations prioritise DLP or identity-led behaviour monitoring first?

A: If the main risk is human misuse of authenticated access, identity-led behaviour monitoring should come first. DLP still matters for classification and enforcement, but it works better when paired with context about who acted, how they acted, and which unmanaged workflows they used. That combination improves triage and reduces blind spots.

Technical breakdown

Why content inspection misses session-driven exfiltration

Traditional DLP tools are built to inspect content and detect prohibited transfers, but they often lack the session context needed to judge whether the transfer is legitimate. That matters because exfiltration frequently happens through valid accounts, active browser sessions, or sanctioned applications. Once a token or authenticated session is stolen, the data move looks normal unless the control plane also understands identity, device state, and session trust. This is why policy engines that only see file contents generate false positives while still missing the path that matters most: authenticated misuse of legitimate access.

Practical implication: pair data controls with session-aware identity controls so approved access and stolen access are not treated the same.

How infostealers turn identity into a data protection problem

Infostealers do not need to defeat content protection first. They target credentials, browser sessions, and other authentication artifacts that let an attacker impersonate a user inside a trusted workflow. That creates a fast path from endpoint compromise to cloud or SaaS data exposure, because the attacker inherits the session’s existing trust and policy exceptions. In practice, the issue is not only theft of a password. It is the reuse of authenticated context, which can bypass controls that assume the user behind the session is still the authorised actor.

Practical implication: treat stolen sessions as a data-loss precursor and monitor for identity misuse, not just malware execution.

Why AI-assisted policy tuning does not solve governance drift

Machine learning can help reduce noise, tune rules, and spot anomalous transfers, but it does not remove the governance burden created by sprawling identities, mixed environments, and changing business workflows. Policy definitions still have to reflect who should access what, from which device, and under what context. If those assumptions are wrong, even adaptive controls can drift into monitor-only mode or generate alerts that teams stop trusting. AI improves triage, but it does not replace identity governance or prove that access is still appropriate at the moment of transfer.

Practical implication: use AI to improve detection quality, but validate that the identity and session policy model is still aligned with real access patterns.

Threat narrative

Attacker objective: The attacker aims to turn valid identity context into silent access to sensitive data and then extract that data through normal-looking workflows.

1. Entry occurs through infostealer compromise or stolen authentication artifacts that give an attacker access to a trusted user session.
2. Credential and session abuse let the attacker operate inside cloud or SaaS workflows without triggering obvious access anomalies.
3. The attacker then uses legitimate application paths to move or copy sensitive data while the access still appears valid.
4. Impact is data exposure or exfiltration that bypasses controls designed only to inspect content rather than trust state.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.
• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data protection has become an identity governance problem, not just a content inspection problem. The controls that decide whether data can move are increasingly session-based, application-based, and user-context-based. That shifts the centre of gravity from what the file contains to who is acting, from where, and under what authentication state. The practitioner implication is clear: data governance and identity governance now have to be designed together.

Identity and session context is the missing control layer in AI-enabled data protection. Adaptive policy engines can reduce noise and improve visibility, but they still depend on a trustworthy answer to a simpler question: is this access genuinely authorised right now? When that answer is absent, the system can only infer from content patterns and transfer behavior, which is too late for many exfiltration paths. Practitioners need to treat session trust as a control domain, not an implementation detail.

Infostealers expose the weakness of content-first security models. A stolen browser session can preserve the appearance of legitimate use while bypassing policy assumptions that were written for a named user on a known device. That is a classic control gap in modern SaaS and cloud operations, where authentication artifacts outlive the trust conditions that created them. The implication is that access validity must be judged at the moment of transfer, not only at login.

Session risk now defines the practical blast radius of data protection failures. Once identity and session trust are compromised, even strong classification and DLP policy design can become reactive rather than preventive. This is especially true in hybrid environments where users move between managed and unmanaged applications and policy enforcement varies by context. The practitioner conclusion is that reducing blast radius depends on governing the session, not just the object being moved.

Named concept: identity-aware data protection. The article points to a governance model in which data controls are evaluated through the lens of identity, session, and device trust rather than content alone. That concept matters because it gives practitioners a more accurate boundary for prevention and forensics in SaaS and cloud workflows. The practical takeaway is to align data protection policy with identity assurance and session lifecycle controls.

What this signals

Identity-aware data protection is the practical shift this article points toward. Policy engines that lack session context will continue to over-index on content and under-govern access, which is why organisations should expect more pressure to unify identity, device, and data controls in the same operational view.

Legacy DLP assumptions break down when access is mediated through SaaS sessions, cloud tokens, and unmanaged application flows. The forward-looking task for security teams is to identify where sensitive transfers depend on authenticated state that outlives the conditions under which it was granted.

For practitioners

• Map data-loss controls to session trust states Inventory where sensitive transfers depend on authenticated browser sessions, SaaS tokens, or long-lived sign-in state. Then identify which transfers can proceed even when the session is no longer trustworthy.
• Review infostealer exposure paths Check whether your detection and response process treats infostealer activity as a precursor to data loss, not just endpoint malware. Focus on stolen credentials, browser artifacts, and active cloud sessions.
• Shift policy design from content alone to context Build rules that combine data type, user role, device posture, and session state so a transfer decision reflects current trust rather than file content alone.
• Test whether monitor-only mode is masking exposure Look for controls that have been softened because of false positives or operational noise. Where teams have disabled enforcement, determine which sensitive data paths are now effectively ungoverned.

Key takeaways

• Data protection programmes fail when they treat file movement as the primary risk and ignore the identity and session state behind the transfer.
• CrowdStrike’s analysis shows that complexity, noisy policy management, and limited visibility still undermine traditional data protection across SaaS and hybrid environments.
• The control boundary is moving toward identity-aware enforcement, where session trust and data governance are handled together instead of separately.

Key terms

• Runtime Trust: Runtime trust is the idea that access should remain valid only while current context justifies it. Instead of trusting a setup decision indefinitely, teams continuously re-evaluate whether a workload or agent still deserves privilege. This approach is especially important for AI agents that can change behaviour mid-task.
• Identity-aware data protection: A control approach that evaluates who is moving data, from where, and under what privileges before allowing or blocking the action. It extends beyond content inspection by tying enforcement to identity, session state, and destination context, which is essential in SaaS, cloud, and automation-heavy environments.
• Infostealer: An infostealer is malware built to collect credentials, session material, tokens, and other authentication data from infected systems. In NHI programmes, the risk is not only theft but reuse, because harvested workload secrets can unlock cloud access long after the initial infection.
• Monitor-Only Mode: Monitor-only mode is a policy stage where controls observe traffic and policy impact without actively blocking communications. Teams use it to validate dependencies, refine rules, and reduce deployment risk before enforcement. It is useful, but it can also prolong projects if organisations avoid making the transition to active control.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.