TL;DR: Data loss prevention now has to follow sensitive information across SaaS, cloud, browsers, GenAI, endpoints, APIs, and MCP-connected workflows, because detection-only controls no longer stop data from moving into the wrong place, according to Strac. The shift matters for IAM and NHI teams because AI tools and agents increasingly create new data egress paths that must be governed, not just observed.
At a glance
What this is: Modern DLP has to govern sensitive data as it moves across SaaS, cloud, browsers, GenAI, APIs and MCP-connected workflows, not just detect exposure after the fact.
Why it matters: IAM, NHI and security teams need controls that govern how data moves through human and machine workflows, because AI tools and agents create new egress paths that policy must now cover.
Context
Data loss prevention is no longer just an email or endpoint problem. The article frames the real governance gap as data moving through SaaS, cloud services, browsers, AI tools and MCP-connected workflows faster than legacy DLP can enforce policy.
The identity angle is real because modern data movement now happens through human users, service integrations and AI agents. That means security teams have to govern both access to data and the path data takes once access is granted.
Key questions
Q: What breaks when DLP only detects data after it has already moved?
A: When DLP is detection only, the security team learns about exposure after the data has already been copied, shared, or transformed in another system. That creates blind spots across collaboration tools and AI workflows. Effective DLP needs enforcement at the point of risk, with controls that can stop or remediate exposure in real time.
Q: Why do AI agents and MCP-connected workflows create new data exposure risks?
A: AI agents and MCP-connected workflows expand access beyond human users into systems that can retrieve, transform, and move sensitive data automatically. That increases the chance of uncontrolled sharing, especially when agents can reach code repositories, tickets, cloud storage, and internal knowledge bases. Security teams need policy enforcement, access visibility, and content inspection around every agent action.
Q: What are the signs that DLP is too narrow for modern SaaS and AI use?
A: A DLP programme is too narrow when it only covers email or endpoints, cannot inspect browser activity, and has no policy coverage for SaaS, GenAI or MCP-connected tools. Another warning sign is when discovery exists in one product but enforcement sits somewhere else, leaving no clear path from finding sensitive data to stopping its movement.
Q: How should teams connect data discovery with data movement controls?
A: Teams should link discovery and enforcement so classification immediately informs blocking, masking or encryption rules. The practical test is whether a newly found sensitive record can trigger a policy response in the same control layer that sees it move. If not, the organisation has visibility but not governance.
Technical breakdown
Why detection-only DLP fails in distributed workflows
Traditional DLP was built around relatively stable enterprise perimeters, such as corporate email, managed endpoints and predictable network paths. Modern workflows break that model because the same sensitive record can move from SaaS to chat, from browser to AI prompt, or from cloud storage to an MCP-connected tool in seconds. Detection can identify content, but it does not control the next hop. The architectural problem is that policy must now travel with the data, not sit only at a gateway.
Practical implication: Shift DLP from passive inspection toward inline enforcement wherever data is created, copied or forwarded.
How MCP changes the data-exposure model
Model Context Protocol connects AI systems to external tools and enterprise data sources, which makes AI more useful and also expands the number of places sensitive data can be retrieved or transmitted. The issue is not only what a user types into a prompt. It is also what an agent can fetch, transform and pass onward through connected tools. Once MCP enters the workflow, data control becomes a problem of governing tool-mediated retrieval and egress, not just user input.
Practical implication: Treat MCP connections as governed data paths and apply policy to tool access as well as prompt content.
Why DLP and DSPM now behave as one control plane
DSPM answers where sensitive data exists and what its posture is. DLP answers what happens when that data moves, is copied or is exposed. The article’s core point is that these functions are converging because visibility without enforcement leaves risk untouched, while enforcement without discovery cannot scale. In practice, the useful unit is a combined data control layer that can discover, classify and then act when policy is violated.
Practical implication: Tie discovery and enforcement together so classification immediately informs blocking, masking, deletion or quarantine.
Threat narrative
Attacker objective: The objective is to move sensitive information into an unauthorised place or workflow without triggering effective inline control.
- Entry occurs when sensitive data is copied into SaaS, pasted into GenAI prompts, or retrieved by an MCP-connected agent from an approved system.
- Credential or content access is then expanded as the same data is duplicated into tickets, files, browser sessions or downstream tools outside the original security boundary.
- Impact follows when the information is exposed, misused or forwarded to an unauthorised destination, creating a data-loss event that legacy detection-only controls may only discover after the fact.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Data movement is now the control surface: The old assumption that protecting the perimeter or the mailbox is enough no longer holds. Sensitive data now travels through SaaS, AI prompts, browser sessions and connected tools, so governance has to follow the data itself. Practitioners should treat data movement as a first-class security domain, not a downstream logging problem.
DLP and DSPM are converging into a single data governance layer: Discovery without enforcement leaves teams with visibility but no control, while enforcement without discovery leaves them blind to where policy needs to apply. That convergence is now structural, not optional. The practical conclusion is that security teams should stop buying isolated point controls and start measuring whether discovery leads directly to action.
MCP introduces a new trust boundary for non-human actors: Once AI agents can retrieve enterprise data and hand it to other tools, the governance question shifts from who can read a file to what a machine can do with it. That is a genuine NHI problem because the agent becomes a data-moving principal with its own access path. Organisations need to govern agent-mediated data paths as carefully as human sessions.
Modern DLP is really about egress governance: The article sharpens a useful concept here: data egress sprawl. The risk is not only disclosure, but the proliferation of sanctioned and unsanctioned routes through which sensitive information can leave its intended context. Practitioners should use that lens to prioritise the highest-volume egress paths first, especially browser, SaaS and AI workflows.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
- Read next: MCP Security Guide
What this signals
Data egress sprawl: The important shift is not simply that more tools handle sensitive data, but that more sanctioned paths now exist for that data to leave its original context. Security teams should prioritise the browser, SaaS and AI routes where users and agents actually move information, because that is where legacy DLP assumptions fail first.
MCP matters because it turns AI from a chat surface into a tool-using runtime that can retrieve enterprise data and pass it onward. That makes MCP-connected agents part of the data-control problem, not just an application integration detail.
The broader programme implication is that discovery, classification and enforcement can no longer be separate workstreams. If a team cannot move from finding sensitive data to acting on its movement in the same policy model, its DLP programme is still operating like a detector rather than a control.
For practitioners
- Instrument SaaS and browser data paths Inspect messages, uploads, downloads and copy-paste actions in the SaaS and browser workflows where sensitive information actually moves, not just where it is stored.
- Apply inline remediation instead of alert-only controls Use redaction, masking, blocking, quarantine or deletion when policy is violated so exposure is interrupted at the point of movement.
- Classify and govern MCP-connected workflows Map which MCP servers, tools and connected apps can retrieve or forward sensitive records, then treat those paths as controlled egress channels.
- Tie DSPM findings to enforcement rules Use discovery results to drive the exact DLP policies that block, mask or encrypt high-risk data as it moves into unauthorised destinations.
- Add AI prompt and upload inspection Inspect prompts, file uploads and agent outputs so GenAI use does not become a blind data egress path for credentials, customer data or internal documents.
Key takeaways
- Modern DLP has to govern where sensitive data moves, not just identify where it exists.
- MCP-connected AI workflows widen the data-egress surface because agents can retrieve and forward information through connected tools.
- The most effective control model joins discovery and enforcement so policy can act at the point of movement.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article explicitly includes credentials, API keys and secrets among the data DLP must govern. |
| NHI-10 — Human Use of NHI | Human users interacting with AI and MCP workflows can move non-human credentials and data across tools. | |
| Recommendation — Scan SaaS, browser and AI workflows for exposed secrets and block their movement before they leave approved channels. Limit human handling of NHI-bound data paths and monitor any session that can pass secrets into AI tools. | ||
| MITRE ATT&CK | TA0009;TA0010 — Collection; Exfiltration | The article centres on collecting sensitive data and sending it to unauthorised destinations. |
| Recommendation — Map data-moving abuse to Collection and Exfiltration techniques and prioritise controls on the highest-risk egress paths. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-Rest is Protected | The article links DLP and DSPM to protecting sensitive data as it moves across systems. |
| Recommendation — Extend data protection controls across stored, in-use and moving data rather than leaving them limited to one state. | ||
| CSA Cloud Controls Matrix | DSP — Data Security & Privacy | The article is fundamentally about discovering, classifying and enforcing controls over sensitive cloud data. |
| Recommendation — Use DSP controls to classify sensitive cloud data and connect those findings to enforcement actions. | ||
Key terms
- Data Loss Prevention: Data loss prevention is the set of controls used to detect, block, and report sensitive data moving in ways the organisation does not allow. In practice, DLP must account for endpoints, email, cloud apps, APIs, and user behaviour, or it will miss the paths where real exposure happens.
- Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Data Egress Sprawl: Data egress sprawl is the expansion of places, tools and workflows through which sensitive information can leave its original context. It is the practical reason legacy DLP struggles, because the organisation no longer has a small set of predictable exit points for data movement.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It helps security and IAM practitioners build the control model needed when human and machine workflows both move sensitive data.
Published by the NHIMG editorial team on August 19, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org