Cyera data risk assessments expose gaps in data security

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cyera's research: Traditional security controls do not provide enough visibility into sensitive data location, access, and protection status.

Why it matters: IAM, NHI, and data security teams need a shared view because data exposure problems now span entitlement design, discovery, and governance rather than a single control domain.

Context

Data risk assessments are a way to compare where sensitive data sits, who can reach it, and whether controls actually reduce exposure. In Cyera’s framing, the gap is not simply more storage sprawl, but the mismatch between modern data movement and the controls many programmes still use to govern it.

The identity connection matters because access control answers only part of the question. If teams cannot connect data location, privilege scope, and protection state, then both human access governance and NHI oversight miss the exposure path. The report’s core message is that data security is now an identity and governance problem as much as a tooling problem.

Key questions

Q: How should security teams govern access when sensitive data is spread across multiple systems?

A: Security teams should classify the data first, then use that classification to drive entitlement review, certification cadence, and revocation logic. Access governance becomes more accurate when approvers can see what an entitlement reaches, not just who holds it. That approach reduces overprovisioning and makes audit evidence easier to defend.

Q: Why do traditional access controls fail to protect sensitive business data?

A: Because they answer only who can log in or reach a system, not where sensitive data lives or how broadly it can move once accessed. In modern cloud and SaaS estates, the same data may be reachable through multiple identities and workflows, so control effectiveness depends on data context as much as permission state.

Q: What are the signs that a data security assessment is missing the highest-risk exposures?

A: Warning signs include a long list of findings with no prioritisation, unknown data repositories, unclear effective access, and remediation plans that stop at reporting. Another red flag is confidence in controls without visibility into exposure, activity, or AI access. If the team cannot explain which sensitive data matters most and why, the assessment is not yet operationally useful.

Q: Should organisations prioritise data discovery or access governance first?

A: They should do both together, but discovery usually comes first when the estate is not well understood. Without knowing where sensitive data resides, access governance becomes a partial exercise that misses the highest-risk datasets. Once discovery is in place, teams can align privileges to actual exposure rather than assumptions.

Technical breakdown

Why perimeter and access controls stop short in data risk assessments

Perimeter security assumes the useful security boundary sits outside the asset, while access control assumes that knowing who has permission is enough to bound exposure. Data risk assessments show why those assumptions fail for distributed data estates, where sensitive information moves across cloud services, SaaS applications, collaboration tools, and AI workflows. The real control question is no longer only whether access exists, but whether the data can be discovered, classified, and governed wherever it appears. Without that linkage, an entitlement review can be formally correct while the exposure path remains unresolved.

Practical implication: map controls to data location and data class, not just to user or service entitlements.

How sensitive data exposure becomes an identity problem

Sensitive data exposure often follows identity paths rather than storage paths. Users, service accounts, API tokens, and application identities can all create access routes that traditional governance teams see separately, even when they converge on the same data set. That is why data risk assessments are useful: they surface the relationship between entitlement scope, overexposure, and business context. For NHI programmes, this matters because machine access to data is often broad, persistent, and poorly reviewed, especially when credentials are embedded in workflows or shared across systems.

Practical implication: tie data discovery outputs to identity inventories so access scope can be evaluated against actual data sensitivity.

Why AI-era data security raises the stakes for governance

AI changes the problem because models and pipelines can learn from, reproduce, or surface sensitive patterns at scale. The issue is not just exfiltration; it is uncontrolled propagation of sensitive information across systems that were never designed to preserve contextual access boundaries. Data risk assessments therefore need to include both protection state and reuse pathways, especially where AI tools consume enterprise content. Cyera’s report points to a shift from static control checks to continuous exposure management across business data flows.

Practical implication: review AI-connected data paths as part of the same governance model used for human and NHI access.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Indian government breach 2021: Sakura Samurai found exposed .git and .env files across Indian government sites, leaking 35 credential pairs, private keys and personal data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data exposure is now an identity governance issue, not a storage issue. Traditional data security models still separate discovery, classification, and access governance, but those layers fail when the same dataset is reachable by humans, service accounts, and AI-connected workflows. The practical consequence is that entitlement review without data context creates false confidence. Practitioners should treat data location and access scope as a single governance object.

Exposure management becomes the missing control plane for modern data estates. The article’s core finding is that organisations cannot rely on perimeter controls to answer where sensitive data lives or how it is protected. That means the control objective shifts from blocking access at the edge to continuously understanding where sensitive data is reachable and how far it can spread. The programme implication is that discovery, classification, and entitlement governance must be operated together.

AI makes data governance more fragile because sensitive patterns can be reproduced, not just stolen. The 43% concern figure signals a broader problem: modern threats do not always need direct data theft to create harm. Once data enters AI-enabled workflows, sensitive patterns can be reused or exposed in ways that outlive the original access decision. The implication is that governance must account for propagation risk, not only access risk.

Named concept: data access blind spot. This is the gap between knowing that a user or service can reach a system and knowing whether that system contains sensitive data worth restricting. Cyera’s report shows that blind spots emerge when data security teams and IAM teams work from different inventories. Practitioners should eliminate that split view before they try to optimise controls.

NHI governance has to extend into data risk assessment. Service accounts and other machine identities often operate with broad, persistent access that is invisible to conventional review cadences. When those identities touch sensitive data, the exposure problem is no longer just data security or just NHI governance. The implication is a combined programme view that can trace machine access back to the data it can actually reach.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Read next: IAM and IGA Basics

What this signals

Data access blind spots: programmes that separate data discovery from identity governance will keep missing the same exposure paths, because permissions alone do not explain which sensitive datasets are actually reachable. The useful next step is to unify classification, entitlement review, and ownership around the data estate, not around individual systems.

AI-connected data flows make this gap more urgent because sensitive patterns can be learned, copied, or resurfaced without a classic exfiltration event. That is why exposure management now has to include AI-aware data handling and service account visibility, not just perimeter controls and static reviews.

For practitioners

• Define a shared data-access inventory Link sensitive data discovery results to the identities that can reach each dataset, including service accounts, tokens, and application identities.
• Reconcile entitlement scope with data sensitivity Review whether each access path is justified by the classification of the underlying data, not only by the user role or system permission.
• Surface machine access routes to data Map NHI credentials and service accounts to the data stores they can query, sync, or export so broad access becomes visible to governance teams.
• Add AI data propagation checks Assess where AI tools may learn, reproduce, or redistribute sensitive information patterns from enterprise content and logs.
• Re-test protection assumptions after discovery Use assessment findings to prioritise the datasets where discovery has revealed protection gaps, then assign control owners for remediation tracking.

Key takeaways

• The core problem is not only data sprawl, but the inability of traditional controls to explain where sensitive information lives and who can reach it.
• Cyera’s report ties data security failures to real-world assessment findings and highlights the operational risk created when discovery and access governance stay disconnected.
• Teams that want better control need a combined view of data classification, entitlement scope, and machine access, especially where AI systems touch enterprise content.

Key terms

• Digital Risk Assessment: A digital risk assessment is the process of evaluating the technologies an organisation has deployed, the vulnerabilities those systems introduce, and the potential business impact if they are abused. It provides the evidence base for prioritising controls, assigning ownership, and building practical mitigation and response plans.
• Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
• Sensitive Data Discovery: Sensitive data discovery is the process of locating where protected or regulated information exists across systems, storage, and workflows. In cloud environments, it must be continuous because assets appear, move, and replicate quickly, making one-off inventories unreliable for governance or incident response.
• Entitlement Scope: Entitlement Scope is the exact set of actions, resources, or permissions attached to an identity during a session. In cloud and NHI governance, scope is as important as duration because broad permissions can turn a short-lived grant into a high-impact access event. Narrow scope is a core control objective.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.