TL;DR: Discovery latency, not just data volume, is now the bottleneck in AI data governance: Sentra says its agentless approach discovered and classified 9 petabytes in under 72 hours with more than 98% accuracy in a Fortune 500 evaluation. The governance issue is that AI agents can operate inside stale maps long before quarterly scans catch up, making continuous discovery a control requirement, not a performance nice-to-have.
At a glance
What this is: Sentra argues that petabyte-scale AI data governance breaks when discovery cannot keep pace, and says its agentless approach mapped 9 petabytes in under 72 hours with more than 98% accuracy.
Why it matters: For IAM, data security, and AI governance teams, the issue is that AI agents can act on data before discovery and classification cycles catch up, so governance now depends on continuous visibility rather than periodic scans.
By the numbers:
- Sentra says it discovered and classified 9 petabytes in under 72 hours.
- Sentra says the evaluation achieved greater than 98% classification accuracy.
Context
Discovery is the control plane for AI data governance, because you cannot classify, restrict, or monitor what you have not found. At petabyte scale, the problem is not only volume but drift, since new data and new AI agent reach can outpace periodic scan cycles.
Agentless discovery changes the operating model by scanning in place inside the customer environment instead of depending on installed agents or repeated full-estate reads. In an agentic environment, that distinction matters because governance has to stay current as access and data change continuously.
Key questions
Q: What breaks when AI agent discovery is incomplete?
A: When discovery is incomplete, the organisation cannot know which agents exist, what they are connected to, or what they can access. That leaves policy enforcement, enrichment, and review operating on a partial inventory, which is the same as governing only part of the environment. Hidden agents become hidden access paths.
Q: Why does stale data discovery increase AI governance risk?
A: Stale discovery increases risk because AI agents inherit access to data that already exists, and they can use that access immediately. If the inventory lags by days or weeks, the organisation cannot reliably know what the agent can see, classify, or move. The result is a blind spot inside the governance model, not just an operational delay.
Q: How do security teams decide whether sampling is safe for data discovery?
A: Use sampling only where the data is structurally repetitive and statistically stable, such as logs, telemetry, or ETL output. Unique human-created content should not be sampled because a single file can carry material risk. The decision should be based on data variance, not convenience.
Q: How do organisations know whether discovery is working?
A: Look for measurable coverage across the full estate, including shadow IT, backups, logs and collaboration tools, plus evidence that classified findings feed into access review and remediation workflows. If discovery only finds known systems, it is not changing governance. Effective discovery reduces unknown repositories and shortens the time from identification to control action.
Technical breakdown
Why full scans fail at petabyte scale
Full scanning assumes the estate can be re-read faster than it changes, which breaks once object counts and pipeline churn reach petabyte scale. Machine-generated data dominates these environments, so the real problem is not just size but skew: logs, telemetry, backups, and ETL outputs create enormous volume with uneven sensitivity. When tools insist on reading every object every cycle, results become stale before governance can rely on them. The architectural issue is throughput against freshness, not just storage capacity.
Practical implication: measure discovery freshness as a control objective, not just scan completion time.
How Smart Clustering and Smart Sampling reduce scan load
Smart Clustering groups objects into data assets using metadata such as path, prefix, schema, and naming patterns, so a million similar files become one governable unit. Smart Sampling then scans representative subsets inside clusters where sampling is statistically valid, which is typically structured or semi-structured machine-generated data. This works because the cluster already defines the population, so the sample can describe the whole asset without random estate-wide guessing. Human-generated documents do not fit that model and still require full inspection.
Practical implication: separate machine-generated datasets from human files so sampling only applies where the structure supports it.
Why delta rescans matter for continuous governance
Delta rescans only reprocess new and changed assets after the initial discovery pass, which turns discovery from a one-time project into a continuously refreshed map. That matters because AI agents inherit whatever data is already present, and a stale inventory creates a governance gap between data creation and policy enforcement. If the map ages by days or weeks, agents can operate inside unseen or newly exposed datasets before the next cycle catches up. Continuous coverage is therefore a governance requirement, not an optimisation detail.
Practical implication: tie discovery refresh cycles to change volume and new AI agent deployment, not to a fixed quarterly cadence.
NHI Mgmt Group analysis
Continuous discovery is now a governance prerequisite, not a reporting feature. AI agents can only be governed against the data and permissions they can actually reach, and that reach changes faster than periodic discovery models were designed to handle. A stale map creates a control gap between exposure and policy enforcement, which means discovery freshness has become part of the governance baseline. Practitioners should treat current-state visibility as an operating requirement for AI-ready data programmes.
Petabyte-scale data discovery failure is really a control-design failure. The issue is not that organisations lack scanning tools, but that many scanning architectures still assume every object must be read every cycle. That assumption collapses under machine-generated volume and skewed datasets, where the expensive part is often the least useful work. The named concept here is discovery drift: the widening gap between where data exists and where governance still believes it is. Practitioners should design for drift, not deny it.
Agentic AI turns stale data maps into active risk. An AI agent does not wait for the next inventory run before it starts using the data it can access. That makes discovery a first-line AI governance control because access, sensitivity, and location all influence what an agent can do next. Identity-aware governance becomes more important here, because the question is not only what data exists but which human, workload, or agent identity can reach it. Practitioners should connect discovery outputs to access governance immediately.
Speed and accuracy must be evaluated together for governance to be credible. Fast results are not enough if classification quality is weak, and high accuracy is not enough if the map is already stale. The article’s real lesson is that governance at scale requires both timeliness and trustworthiness, especially when discovery underpins remediation and access decisions. Practitioners should evaluate discovery platforms on continuous freshness, classification fidelity, and environment-native execution.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Maturity Model
What this signals
Discovery drift: the gap between data creation and governance visibility is becoming the core failure mode in AI data programmes. When AI agents can reach new datasets as soon as they appear, a discovery model that refreshes slowly creates blind spots that are operational, not theoretical.
The governance implication is straightforward: discovery has to be measured by freshness, coverage, and trust in classification, not by whether a scan eventually completes. For teams aligning to NIST AI Risk Management Framework, the control question is whether current-state visibility is good enough to support downstream decisions.
For practitioners
- Define discovery freshness as a governance metric Track how long it takes for newly created or changed data to appear in governance workflows, and set targets that reflect AI agent deployment speed rather than audit cadence.
- Separate clustered machine data from human content Apply sampling only to structured and semi-structured machine-generated datasets, while requiring full scanning for unstructured human documents and contracts.
- Use delta rescans for change-driven coverage Re-scan only new and changed assets after the initial inventory so the discovery map stays current without repeating full-estate work.
- Map AI agent access to discovered assets Join discovery outputs to identity and access records so agent permissions are evaluated against current data locations, not stale inventory views.
Key takeaways
- AI data governance fails when discovery lags behind the pace at which data and agent access change.
- The article frames petabyte-scale discovery as a control problem, with 9 petabytes scanned in under 72 hours and more than 98% classification accuracy in a Fortune 500 evaluation.
- Continuous discovery, delta rescans, and identity-aware access mapping are the practical levers that keep AI agents from operating inside an unseen data estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | MAP — AI Risk Mapping | Discovery freshness is part of mapping the data and exposure context for AI systems. |
| MANAGE — AI Risk Management | Continuous discovery is a governance control needed to manage AI-enabled access risk. | |
| Recommendation — Map current data visibility and agent reach so governance decisions use live estate context. Operationalise ongoing monitoring so AI risk controls stay aligned to current data exposure. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | Current inventory and visibility are central to the article's discovery problem. |
| Recommendation — Maintain an up-to-date inventory of governed data assets and refresh it continuously. | ||
| NIST SP 800-53 Rev 5 | CM-8 — System Component Inventory | The article is fundamentally about keeping an accurate, current inventory at scale. |
| Recommendation — Apply CM-8 to maintain authoritative inventories of data assets and their changes. | ||
| MITRE ATT&CK | TA0007 — Discovery | The article centers on finding and enumerating data assets before agents can use them. |
| Recommendation — Hunt for discovery gaps that leave unknown or newly exposed data outside monitoring. | ||
Key terms
- Agentless Data Discovery: Agentless data discovery is the process of finding and classifying data without installing software on the systems that store it. The scanner runs inside the customer environment, reads data in place, and returns metadata for governance while reducing operational overhead and data movement risk.
- Discovery drift: Discovery drift is the gap that opens when live infrastructure, asset records, and ownership data move out of sync. It creates uncertainty about what exists, who owns it, and which controls apply, which in turn weakens zero trust enforcement and lifecycle governance.
- Delta Rescan: A delta rescan reprocesses only new or changed assets after an initial discovery pass. It keeps the data map current without repeating full-estate scanning, which is essential when petabyte-scale environments change faster than a traditional inventory cycle can finish.
- Smart Sampling: Smart sampling is a targeted scanning method that examines a statistically representative subset of repetitive, machine-generated data. It is only appropriate where cluster structure and content patterns make the sample reliable, and it should never replace full inspection of unique human-generated files.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to connect identity controls to broader security programmes. Explore it if your role now includes governing human, machine, and agent access across changing environments.
Published by the NHIMG editorial team on August 18, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org