Enterprise AI needs context-aware data security, not DSPM alone

At a glance

What this is: Seclore argues that enterprise AI breaks static data security because context graphs and behaviour-aware assistants can surface and redistribute sensitive information far beyond what discovery tools alone can govern.

Why it matters: This matters because IAM, NHI, and data security teams need controls that govern access at use time, not just discovery time, as AI systems act on behalf of users and workloads.

Context

Enterprise AI changes the security problem from locating sensitive data to controlling how that data is interpreted, combined, and redistributed at runtime. Traditional DSPM can identify where information sits, but it does not by itself govern the context-aware queries, summaries, and downstream access patterns that AI assistants create. That gap becomes sharper when machine-driven access is fast, broad, and difficult to distinguish from legitimate business use.

The article’s core point is that AI security and data security now overlap with identity governance. When an AI assistant, service account, or partner workflow can act with inherited permissions, the real control question becomes whether access is bounded by intent, context, and purpose. In that sense, enterprise AI turns data access into an identity problem as much as a classification problem.

Key questions

Q: How should security teams govern AI access to a security graph?

A: Treat AI access to a security graph like any other privileged integration. Scope the data the assistant can query, filter sensitive fields, and require full audit logging for prompts, returned context, and downstream actions. If the assistant can infer exposure or blast radius, the access path needs ownership, review, and offboarding controls just like other NHIs.

Q: Why do agent context protocols increase the risk of data leakage in AI systems with real system access?

A: Agent context protocols increase data leakage risk because they expand what the model can see and influence. When an LLM can read live files, messages, or system state, compromise of any connected service can expose more than the model prompt itself. The danger is not only model theft, but unauthorized access to the surrounding context pipeline.

Q: What are the signs that AI training controls for private data are failing?

A: Common warning signs include unclear privacy notices, rapid policy revisions without plain-language explanation, default-on sharing settings, and inability to state confidently which content is excluded from model training. A further signal is user confusion about whether paid or private communications are covered by stronger protections. Those conditions suggest governance is lagging product change.

Q: Should organisations prioritise DSPM before tightening AI usage policies?

A: Yes, if they lack clear visibility into where sensitive data sits and how it moves. AI usage policies matter, but they are weak if teams cannot find the data being consumed or copied by tools and users. Discovery and classification should come first because policy enforcement depends on knowing the asset and its exposure.

Technical breakdown

Why context graphs change the data security model

A context graph is more than an index of documents. It links entities, actions, timing, and relationships so an AI system can infer what data is relevant even when the user does not name a file directly. That makes enterprise AI more useful, but it also weakens static security assumptions because permissions are no longer applied only at the point of storage. The security model has to account for what the AI can infer, combine, and resurface from multiple sources at once.

Practical implication: govern AI access based on context and purpose, not just repository location or folder permissions.

Why visibility is not the same as enforcement

DSPM can answer where sensitive data lives and who can potentially reach it, but that is only a discovery layer. It does not automatically constrain the next action an AI system takes after it has read, summarised, or correlated the data. Once an assistant can act at machine speed, the risk is not only exposure but redistribution, because a single query can trigger broad downstream access. Security therefore has to move from inventory to runtime enforcement.

Practical implication: pair discovery with active policy enforcement that follows the data into AI workflows.

How behaviour changes the trust decision

User and Entity Behaviour Analytics matters because intent is inferred from patterns, not labels. A human downloading a few documents for a report and an AI agent or compromised account pulling thousands of records in seconds create very different risk signals, even if the source permissions look similar. Behaviour-aware controls help distinguish normal productivity from data exfiltration or overreach. In AI environments, the trust decision has to include who or what is acting, how fast, and for what workflow.

Practical implication: baseline normal AI and user behaviour so anomalous access can be restricted before broad redistribution occurs.

Threat narrative

Attacker objective: The objective is to reach and redistribute sensitive enterprise information at machine speed while appearing to operate within legitimate workflow access.

1. Entry occurs when an AI assistant, partner workflow, or service account is granted broad access to enterprise content under flat permissions.
2. Credential or entitlement abuse follows when the actor inherits more data access than the immediate task requires, allowing context-graph queries to reach adjacent sensitive material.
3. Impact occurs when the AI summarizes or redistributes confidential documents, creating enterprise-wide leakage without a classic exfiltration event.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Context-aware security is becoming the real control plane for enterprise AI. Discovery can tell you where sensitive data lives, but it cannot govern how assistants interpret and reuse that data once it enters a context graph. The security boundary now has to follow the data through retrieval, summarization, and redistribution, which is a materially different governance problem. Practitioners should treat AI runtime behaviour as part of the control surface, not just the application layer.

The old DSPM model is necessary but incomplete. Static classification still matters, but it is no longer sufficient when an AI system can combine separate fragments into a more sensitive whole. That creates a new kind of governance debt: organisations believe they have visibility, yet the real exposure happens at the moment of inference. The practical conclusion is that discovery must be paired with continuous policy enforcement.

Context graph overreach: the failure mode is not data that is unknown, but data that is too broadly inferable. When permissions are flat and static, AI can surface board material, M&A documents, and regulated content simply because the underlying graph connects them to a legitimate prompt. This is an identity and authorisation issue as much as a data issue, because the actor may be a human, a service account, or an agent operating under inherited access. Practitioners should govern graph reachability the same way they govern privileged access.

Behaviour-aware controls are now essential for AI data governance. UEBA gives security teams a way to distinguish routine business use from anomalous access that signals overreach or abuse. In practice, that means treating speed, volume, and workflow context as first-class signals. The field is moving toward dynamic trust decisions, and teams that do not incorporate behaviour will remain blind to machine-speed redistribution risks.

Persistent enforcement should travel with the data. The most defensible posture is to keep governance attached to content wherever it moves, including into collaboration tools, vendor sharing, and AI context layers. That aligns with NIST-CSF access control principles and supports the core lesson of data-centric security: control must survive movement, reuse, and reprocessing. Practitioners should design for data that remains governed after discovery ends.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Context-aware governance will become the default expectation for enterprise AI. Security teams will be judged less on whether they can locate sensitive data and more on whether they can constrain how AI uses it once discovered. The practical shift is from static discovery to enforceable policy that follows the content into assistants, agents, and collaboration layers.

Service-account visibility remains a weak point in most environments. Only 5.7% of organisations have full visibility into their service accounts, which is a reminder that the identities driving AI-connected access are often less governed than the data itself. That gap matters because AI assistants frequently inherit access through connectors and workloads rather than through human login events. Practitioners should expect identity blind spots to become data security failures.

AI-connected identities need the same discipline as privileged human access. If a connector, agent, or service account can reach sensitive content through inherited permissions, it should be governed as a high-risk identity with explicit scope, review, and containment. The programme implication is clear: classify the actor, measure its normal behaviour, and limit what it can infer, not just what it can open.

For practitioners

• Map AI data reachability, not just data location Inventory which documents, chats, tickets, and repositories each assistant or agent can actually reach through the context graph, then compare that reach to the task it is supposed to perform.
• Add runtime policy enforcement to AI workflows Apply controls that evaluate every AI read, summary, and redistribution step so classification is enforced when content is used, not only when it is found.
• Baseline behaviour for humans and AI actors Establish normal query volume, access rate, and workflow patterns for employees, service accounts, and AI agents so anomalous bulk retrieval can be flagged quickly.
• Tighten privileges for AI-connected identities Review the entitlements behind assistants, connectors, and service accounts so inherited access does not exceed the smallest workflow needed for the task.
• Preserve evidence of controlled data handling Retain audit trails that show what the AI accessed, what it summarised, and what it redistributed so security and compliance teams can prove governance decisions later.

Key takeaways

• Enterprise AI changes the control problem from finding sensitive data to governing how AI systems can infer, summarise, and redistribute it.
• Static DSPM remains useful, but it does not by itself stop context-graph queries from exposing adjacent confidential material at machine speed.
• The strongest response is to combine discovery, behaviour analytics, and persistent enforcement so AI access is constrained at use time.

Key terms

• Context graph: A persistent data layer that links telemetry with organisational knowledge such as asset ownership, tickets, prior investigations, and business workflows. It gives AI systems the context needed to interpret alerts correctly instead of guessing from isolated logs.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Behaviour-Aware Access Control: Behaviour-aware access control uses activity patterns, volume, timing, and workflow context to decide whether access should continue. It is especially relevant where AI agents and service accounts can perform actions far faster than a human reviewer can assess them.
• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme that AI now depends on.