AI-native DLP is exposing the limits of legacy data loss controls

At a glance

What this is: This is Nightfall’s analysis of the Nike breach and why legacy DLP failed to stop bulk exfiltration of operational data.

Why it matters: It matters because IAM and security teams must govern data movement, access context, and user behaviour together when sensitive information spans identities, devices, and cloud services.

By the numbers:

• 2020 to 2026 across business operations.

👉 Read Nightfall's analysis of the Nike breach and AI-native DLP limits

Context

Data loss prevention breaks down when sensitive information is treated as a static file property rather than a moving business asset. In this case, the primary issue is not just exfiltration volume, but the inability of legacy controls to follow data as it crosses collaboration tools, endpoints, and cloud storage. That creates a governance gap for both human users and non-human workflows that can copy, stage, and transmit data at scale.

For identity and access teams, the important lesson is that access control alone does not describe the full risk picture. A user or contractor may have legitimate access to individual files, yet still create an exposure path when related artifacts are collected across time and combined into usable competitive intelligence. That is a familiar pattern in modern NHI-heavy environments, where service accounts, integrations, and shared workspaces can multiply the blast radius of weak data governance.

Key questions

Q: What breaks when DLP only looks for known file patterns?

A: Static DLP misses the larger risk when individually ordinary files become sensitive through context, volume, and timing. A bill of materials, audit report, or design draft may not trigger a rule on its own, but a coordinated batch can expose competitive intelligence. Effective controls must evaluate sequences of access and movement, not just labels at exit points.

Q: Why do collaboration tools increase privacy risk for personal data?

A: Collaboration tools concentrate customer, employee, and vendor information in shared spaces that were built for speed, not retention governance. Personal data can spread through threads, attachments, screenshots, and exports, which makes the exposure surface broader than a single message. Organisations need deletion and audit controls because the risk is lifecycle persistence, not just disclosure.

Q: How do security teams know if exfiltration controls are actually working?

A: Look for evidence that bulk file access, compression, and outbound staging are detected early and correlated with privileged sessions. If teams only see the breach after a leak site post, the control failed. Effective monitoring should surface unusual data movement before attackers can weaponise it.

Q: Who is accountable when data access is granted through automated workflows?

A: Accountability stays with the organisation that defines the workflow, approval rules, and revocation process. Automation does not remove ownership. If a workflow grants access incorrectly or fails to revoke it on offboarding, the control gap is a governance failure, not an automation problem.

Technical breakdown

Why static DLP rules miss contextual data theft

Legacy DLP typically relies on predefined patterns, labels, or file types. That works for obvious records such as payment data, but it fails when sensitive value sits in combinations of documents, metadata, and business context. A single file may look harmless on its own, yet a batch of related files can reveal product plans, manufacturing methods, or partner relationships. The technical gap is that perimeter scanning sees objects, not sequences of behaviour across systems.

Practical implication: teams need controls that evaluate data context and collection patterns, not just file content at the point of egress.

How data discovery and classification change the control model

AI-assisted data discovery is designed to scan cloud storage, SaaS applications, endpoints, and repositories continuously, then infer sensitivity from content and relationships instead of manual tags alone. This matters because classification drift is inevitable in fast-moving engineering and supply chain environments. The control model shifts from static policy enforcement to continuous data understanding, which is especially important where collaboration tools and NHI-driven automation repeatedly copy or transform data.

Practical implication: organisations should map sensitive data discovery to every store where identities, integrations, and workflows can create hidden copies.

Why exfiltration prevention must track behaviour over time

Modern data theft often starts as low-and-slow collection before turning into rapid extraction. Behaviour-based exfiltration detection looks for unusual volume, timing, destination, and file combinations across a session or longer window. That is a better fit for today’s threat patterns because attackers often stay inside legitimate access boundaries until enough context has been accumulated. In practice, this makes data movement telemetry as important as identity telemetry.

Practical implication: teams should treat repeated bulk access as a risk signal and pair it with adaptive controls such as step-up authentication or access revocation.

Threat narrative

Attacker objective: The attacker’s objective is to convert distributed operational files into a complete competitive-intelligence package that can be monetised, leaked, or used for leverage.

1. Entry occurs through legitimate access to corporate repositories, collaboration tools, or partner-connected systems where valuable files can be collected over time.
2. Escalation happens when related documents are staged across multiple locations, allowing the attacker to assemble product, supply chain, and operational intelligence into a reusable set.
3. Impact arrives when the accumulated dataset is extracted in bulk, enabling competitive theft, extortion, or downstream misuse of sensitive business information.

NHI Mgmt Group analysis

Static data protection is no longer enough for modern data governance. The Nike case shows that sensitive information now moves through a mesh of collaboration tools, endpoints, and cloud services before it ever reaches an exit point. When controls only inspect known patterns at the perimeter, they miss the business context that turns ordinary documents into competitive intelligence. Practitioners should treat contextual data governance as a core control objective, not an optional enhancement.

Context sprawl is the real control gap here. The breach worked because no single file carried the full risk, yet the collection of files did. That is the failure mode modern programmes need to name and measure, especially under NIST-CSF and CIS-CONTROLS where inventory, monitoring, and access governance must work together. For IAM and NHI teams, the lesson is that access reviews without data-context visibility leave a blind spot in the control stack.

Data movement telemetry is becoming a first-class security signal. Organisations cannot rely on classification alone when business value is produced by relationships between documents, not isolated records. This is where NHI governance intersects with broader data security: service accounts, integrations, and machine-driven workflows can move large volumes of information without the social cues that normally trigger suspicion. The practical conclusion is that programme owners need continuous behavioural visibility across users and non-human actors.

Value-chain extortion is the named concept this breach sharpens. The article describes a shift from customer-data theft to the theft of operational and strategic assets that define enterprise advantage. That changes the priority order for security leaders, because the most damaging losses may never include PII or payment data. Practitioners should align controls to protect the information that drives operations, manufacturing, and product design, not only regulated records.

AI-native DLP is really a governance model for data that behaves like identity-linked infrastructure. As data moves through people, applications, and automated workflows, the security problem becomes one of lifecycle control, not single-point inspection. That means the field needs a tighter bridge between data security, IAM, and NHI oversight. Teams that still separate those domains are likely to underestimate how quickly business intelligence can be assembled and removed.

What this signals

Context-aware data governance is becoming a security baseline. Security teams should assume that sensitive business value will emerge from combinations of files, not isolated records, and that adversaries will exploit the gap between classification and usage. The practical shift is toward behavioural controls that join data telemetry, identity telemetry, and application telemetry across the full workflow.

Identity and data security are converging around the same control problem. When service accounts, integrations, and human users can all move data through the same collaboration stack, the question is not just who has access, but how data can be staged, transformed, and extracted. Teams should expect stronger scrutiny of download patterns, cross-system copies, and risk-based access interventions, especially where [The 52 NHI breaches Report](https://nhimg.org/52-non-human-identity-breaches) has shown recurring machine identity exposure patterns.

Value-chain extortion will push more programmes toward behavioural detection. The next wave of DLP maturity is less about better labels and more about detecting when a normal workflow starts assembling an attack payload. For practitioners, that means aligning detection with the business processes that create the most valuable data, not only the systems that store it. For broader guidance on identity-linked exposure paths, see the [52 NHI Breaches Analysis](https://nhimg.org/52-non-human-identity-breaches).

For practitioners

• Map sensitive-data paths across collaboration tools Identify where design files, factory audits, strategic decks, and partner data are copied into Slack, Drive, laptops, and shared workspaces, then document the identity and system involved at each hop.
• Replace label-only rules with contextual detection Use content, file relationships, and collection patterns to decide when a group of individually low-risk files becomes sensitive when taken together.
• Trigger adaptive controls on bulk collection Step up authentication, pause downloads, or revoke access when repeated access patterns resemble staging for exfiltration rather than normal work.
• Tie NHI access to data movement monitoring Review service accounts, integrations, and automation paths that can copy or export data without human review, especially where large volumes can be moved silently.

Key takeaways

• Legacy DLP failed here because it treated sensitive data as a static classification problem instead of a moving business process.
• The scale of the breach shows why behavioural detection and contextual discovery matter more than perimeter scanning alone.
• Security teams need controls that follow data across users, applications, and NHI-driven workflows before bulk exfiltration is complete.

Key terms

• Runtime Data Exfiltration Prevention: Runtime data exfiltration prevention is the practice of stopping sensitive data from leaving an environment at the moment it is about to move. Unlike batch scanning or retrospective discovery, it focuses on immediate classification, blocking, redaction, or remediation across live user and agent activity.
• Context-aware classification: Context-aware classification uses surrounding document meaning, not just keywords, to determine what a file or record represents. It reduces false positives and helps security teams distinguish incidental references from content that is genuinely high consequence.
• Value-Chain Extortion: A theft pattern in which attackers target operational, strategic, or production data that supports enterprise value rather than only personal records. The goal is to create leverage through exposure, disruption, or competitive loss, often by aggregating seemingly ordinary files into a high-value dataset.
• Data Movement Telemetry: Visibility into how information is copied, shared, uploaded, downloaded, or staged across users, applications, endpoints, and cloud services. It provides the behavioural signal needed to distinguish legitimate business flow from the early stages of exfiltration.

What's in the full article

Nightfall's full report covers the operational detail this post intentionally leaves for the source:

• The detailed AI-native DLP workflow for discovery, classification, and exfiltration prevention across endpoints and SaaS.
• The per-stage detection logic for bulk downloads, unusual destination changes, and contextual risk scoring.
• The practical examples of how step-up authentication and revocation controls are applied when exfiltration patterns emerge.
• The report’s framing of value-chain extortion and why operational data now matters as much as regulated data.

👉 Nightfall's full report covers the breach chain, contextual detection model, and operational controls in more detail.

Deepen your knowledge

NHI Mgmt Group’s NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and agentic AI identity. It gives practitioners a structured way to connect identity controls to the wider security programme.