TL;DR: Data growth is accelerating toward 395ZB by 2028, while AI, SaaS sprawl and hybrid cloud expansion are multiplying the places sensitive information can reside, according to Ground Labs' analysis of IDC, Okta and Flexera data. The governance challenge is no longer just storage volume, but continuous discovery, classification and access control across fragmented estates.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Ground Labs's blog post: AI-driven data sprawl is making data-centric governance, especially DSPM, a core control layer for finding, classifying and governing sensitive information across fragmented environments.
Why it matters: For IAM, NHI and broader security teams, the issue is not just where data sits but who and what can reach it, including users, SaaS apps, AI tools and third-party services.
By the numbers:
- By 2028, the amount of data created, captured, replicated and consumed worldwide will reach almost 395ZB.
- Companies with 2,000 or more employees deploy an average of 247 apps.
- 70% of organisations are operating hybrid cloud environments.
Context
AI has turned data growth into a governance problem, not just a storage problem. When information spreads across SaaS, cloud and AI tools, traditional perimeter-based security no longer provides enough visibility or control over where sensitive data resides and how it is used.
DSPM is the practical response to that fragmentation because it focuses on discovery, classification, exposure and policy enforcement at the data layer. The identity angle is direct: human users, service accounts, apps and AI tools all become pathways to sensitive information, so access governance has to extend beyond static perimeter thinking.
That makes this article relevant to IAM, NHI and data security programmes at the same time. The starting position described here is increasingly typical for modern enterprises, not an edge case.
Key questions
A: Security teams should start by discovering where sensitive data lives, who can reach it, and which identities or services are overexposed. Then they should prioritize least privilege, access review, and continuous monitoring across cloud, SaaS, and AI workloads. A practical data security posture management program helps convert unknown data risk into controllable scope for remediation.
A: Perimeter controls assume data stays inside a defined boundary, but modern estates replicate it across cloud, SaaS and AI services. Once information is copied into distributed tools, the useful control point becomes the entitlement and usage path. That is why data-centric governance has to follow the asset, not the network edge.
Q: What are the signs that data governance is failing in a mixed cloud and legacy environment?
A: Common warning signs include unknown data locations, inconsistent classification, unclear access ownership, and ad hoc retention decisions. Teams also struggle when security controls differ across on premises and cloud repositories, creating uneven protection for the same data type. Those conditions usually indicate governance has become fragmented, which increases the chance of data loss, corruption, and avoidable compliance gaps.
Q: Should organisations prioritise DSPM before tightening AI usage policies?
A: Yes, if they lack clear visibility into where sensitive data sits and how it moves. AI usage policies matter, but they are weak if teams cannot find the data being consumed or copied by tools and users. Discovery and classification should come first because policy enforcement depends on knowing the asset and its exposure.
Technical breakdown
Why data discovery fails in fragmented estates
Data discovery fails when organisations assume they already know where sensitive information lives. In hybrid cloud, SaaS and AI-heavy environments, data appears in databases, files, logs, collaboration platforms and third-party tools, often outside formal inventory. Discovery has to identify both structured and unstructured assets, then map them to owners, sensitivity and usage. Without that baseline, downstream controls such as retention, access reviews and AI usage restrictions are blind.
Practical implication: build continuous discovery across cloud, SaaS and on-premises data stores before relying on classification or policy enforcement.
How access reviews change when AI and SaaS touch the data path
Access reviews are no longer just about human entitlements. The article shows why organisations must also account for the applications, AI tools and third-party services that can ingest, replicate or expose data. In practice, the access question becomes contextual: who can reach the data, through which service, for what purpose, and whether that path is approved. This is where DSPM intersects with IAM and NHI governance because service identities and app integrations often hold the effective access.
Practical implication: extend entitlement review to non-human access paths and data-processing services, not only user accounts.
Why continuous monitoring is now the control boundary
Continuous monitoring matters because data estates are not static. New AI tools, shadow SaaS, migrated workloads and replicated datasets create fresh exposure faster than periodic review cycles can detect. DSPM treats governance as an ongoing loop of discovery, risk assessment, policy enforcement and re-evaluation. That matters for insider risk, ransomware resilience and supply-chain exposure because the control objective is to detect new sensitive stores before they become an untracked liability.
Practical implication: treat monitoring cadence as a control requirement, and tie alerts to newly discovered stores, apps and services.
NHI Mgmt Group analysis
Data-centric governance is now an identity problem as much as a data problem. Once data moves through SaaS platforms, AI tools and third-party services, the effective control point shifts from the perimeter to the access path. That means human identity, application identity and non-human identity governance all become part of the same exposure problem. Practitioners should treat DSPM as the layer that reveals where identity governance is failing at the data boundary.
Shadow data is the named failure mode this article exposes. The control gap is not simply missing encryption or weak policy wording, but the absence of continuous knowledge about where sensitive information exists and who can reach it. When organisations cannot identify their data estate, access reviews and least-privilege rules cannot be meaningfully enforced. Practitioners should focus first on eliminating unknown data stores and unmanaged access paths.
AI expands data sprawl faster than governance models can absorb it. Generative AI does not just consume data, it multiplies replication, inference, sharing and output risk across environments that were already fragmented. That changes the governance burden from occasional classification to ongoing control of usage, exposure and reuse. Practitioners should assume that AI adoption will keep widening the policy surface unless data controls are made continuous.
DSPM is best understood as the operating layer between governance intent and technical enforcement. The article correctly ties discovery, classification, threat detection, risk assessment and policy enforcement together because isolated controls do not solve distributed exposure. Where IAM answers who can access, DSPM answers whether the data should be reachable in the first place and whether that reach is still justified. Practitioners should align DSPM with identity, cloud and privacy governance rather than treating it as a standalone data tool.
What this signals
Shadow data is becoming a governance boundary, not a cleanup issue. Once data is duplicated into AI tools, SaaS platforms and hybrid cloud services, the risk is not just leakage but loss of control over whether the data should be there at all. Practitioners should make discovery and ownership assignment continuous rather than episodic.
Identity governance and DSPM now overlap at the data layer. Access reviews that stop at human accounts miss the app and service identities that often carry the real access path to sensitive information. Programmes that align entitlement governance with data classification will get a much clearer picture of exposure.
Continuous monitoring is the practical answer to AI-driven data sprawl. As new tools and workloads appear, governance has to detect fresh stores of information before they become liabilities. The control objective is not perfect cataloguing, but fast enough detection to keep policy and exposure aligned.
For practitioners
- Implement continuous data discovery Inventory structured, unstructured and semi-structured data across cloud, SaaS and on-premises locations, then refresh the inventory as new tools and workloads appear.
- Extend access reviews to data-processing services Review not only user permissions but also application integrations, AI tools and third-party services that can ingest, copy or expose sensitive datasets.
- Classify data by sensitivity and business context Tag information by type, sensitivity, owner, purpose, master location and retention period so policy decisions can follow the data lifecycle.
- Automate enforcement for unacceptable exposure Use least privilege, multifactor authentication, encryption or tokenization, and policy automation to reduce recurring oversharing and misconfiguration.
- Monitor for newly created shadow data Set alerts for new stores, apps and services so governance teams can intervene before they become a liability in ransomware or supply-chain scenarios.
Key takeaways
- AI-driven data sprawl makes the location, sensitivity and reachability of information a governance issue, not just a storage issue.
- The article ties rising data volume to fragmented access paths across cloud, SaaS and AI tools, which is where exposure now accumulates.
- Continuous discovery and policy enforcement are the controls that matter most when data moves faster than periodic reviews can track it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack surface, NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | DSPM centres on identifying and protecting sensitive data across distributed estates. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article emphasises who and what can reach sensitive data across SaaS and AI paths. | |
| ID.AM-02 — Software, hardware, data, and associated assets are inventoried | Discovery and identification are the foundation of the DSPM model described in the article. | |
| Recommendation — Map sensitive-data locations to PR.DS-01 and verify protection controls wherever data is stored. Review entitlements under PR.AA-05 for users, apps and service identities that access sensitive data. Use asset inventory discipline to locate data stores, services and data-processing applications. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least-privilege access is one of the mitigation controls named for reducing data exposure. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Continuous monitoring and evaluation depend on reviewing data-access and exposure signals. | |
| Recommendation — Apply AC-6 to limit access paths to sensitive datasets and reduce oversharing. Use AU-6 to review anomalous data access and surface newly exposed stores quickly. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article's governance model depends on knowing who and what has access to data assets. |
| Recommendation — Use account management to remove stale access to datasets and services that no longer need it. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | The article explicitly cites platform and service misconfigurations as a source of data exposure. |
| Recommendation — Treat insecure service configuration as an exposure path and harden API and service settings. | ||
| GDPR | Art.32 — Security of Processing | The article discusses protection of personal and sensitive data across complex processing environments. |
| Recommendation — Apply Article 32 by matching processing risk to controls that protect sensitive data in transit and at rest. | ||
Key terms
- Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
- Shadow Data: Shadow data is sensitive information that exists outside the places security teams expect to find it. It often appears in testing copies, ad hoc exports, SaaS tools, or AI workflows, which makes it hard to govern with inventory-based controls alone.
- Data-Centric Governance: Data-centric governance is an operating model that places the data itself at the centre of security, access, and compliance decisions. Instead of relying only on network or platform boundaries, it ties control decisions to sensitivity, location, duplication, and the identities that can reach each dataset.
- Hybrid Cloud Exposure: The risk created when data, services and controls span on-premises systems and multiple cloud environments. It increases the number of places where information can be stored, replicated or accessed, making visibility and enforcement harder to sustain consistently.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect identity control to the broader security and data governance programmes their environments depend on.
Published by the NHIMG editorial team on August 25, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org