Policy-based DLP is failing under Shadow AI and SaaS workflows

At a glance

What this is: Orion argues that policy-based DLP is no longer keeping pace with shadow AI, where employees move sensitive data into unmanaged AI tools and SaaS workflows outside traditional inspection boundaries.

Why it matters: This matters because IAM, data security, and AI governance teams need controls that understand context and usage, not just policy matches, when sensitive information flows through unsanctioned AI services.

Context

Data loss prevention was built to inspect known traffic patterns, known destinations, and known rules. That model struggles when data moves through conversational AI tools, copilots, and SaaS workflows that reshape content in ways static policies cannot reliably classify or block.

The governance problem is not only exfiltration. When employees place proprietary code, customer data, or regulated information into unmanaged AI systems, the organisation loses visibility into retention, processing, and reuse. That creates a genuine control gap at the intersection of data security, SaaS governance, and AI usage oversight.

Shadow AI is therefore not just an app sprawl issue. It is a boundary problem where sensitive data leaves the enterprise control plane without the contractual, technical, or identity assurances that traditional DLP assumptions depend on.

Key questions

Q: What fails when policy-based DLP meets shadow AI?

A: Policy-based DLP fails when the organisation cannot see the tool or the workflow before data moves. Without that visibility, the control cannot write a relevant rule, so prevention depends on after-the-fact tuning instead of live enforcement. The gap is operational, not theoretical: unknown AI use turns policy coverage into a lagging indicator.

Q: Why does shadow AI increase data exposure risk more than ordinary shadow IT in regulated environments?

A: Shadow AI is riskier because data is often entered through a prompt and ingested instantly, which can create immediate and sometimes irreversible exposure. Unlike a typical unsanctioned app, a consumer AI tool may retain inputs, lack a BAA, and bypass traditional network-based monitoring when users paste data locally or use desktop clients.

Q: What are the signs that legacy DLP is failing against AI agent traffic?

A: Common signs include high alert volume with few prevented events, data moving through SaaS or browser paths that are not being blocked, and sensitive actions happening inside automated sessions that never reach human intervention. Those signals indicate visibility exists, but enforcement does not.

Q: How should security teams govern sensitive data used by AI systems?

A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication. Classify sensitive data, define which datasets may enter AI workflows, and monitor outputs, logs, and downstream reuse. If governance stops at login, the organisation can approve access while still losing control of the data itself.

Technical breakdown

Why policy-based DLP fails against conversational AI workflows

Traditional DLP depends on predefined signatures, regex patterns, file hashes, and policy rules that assume data will appear in predictable places. Conversational AI breaks that model because the same sensitive content can be paraphrased, synthesised, indexed, or embedded inside prompts and responses instead of moving as a file or message. The inspection point also shifts: the risk is no longer just outbound transmission, but data being entered into a system the organisation does not control. That makes static pattern matching too brittle and too slow for modern workflows.

Practical implication: Treat AI-facing data paths as a separate control surface, not as an extension of legacy DLP rule sets.

How shadow AI changes the data control boundary

Shadow AI describes unsanctioned or unmanaged AI use by employees without formal security review, governance, or contractual safeguards. In that state, the organisation cannot depend on provider-side logging, retention controls, or deletion guarantees. The problem is less about the tool category and more about the loss of enforceable control once sensitive data leaves approved boundaries. This is why blocking every AI interaction rarely works, yet allowing unrestricted use also creates compliance and intellectual property exposure.

Practical implication: Build governance around approved use, visibility, and retention terms before sensitive data is allowed into AI workflows.

Why context-aware protection matters more than pattern matching

Context-aware protection looks at who is sharing data, what the data is, where it is going, and whether the action matches legitimate business intent. That is materially different from legacy DLP, which tries to infer risk from content alone. In practice, this approach combines classification, behavioural analysis, and policy decisions at the point of use. For identity and access teams, that means the security decision is no longer only about content inspection. It also depends on who the user is, what application they are using, and whether that session should be trusted.

Practical implication: Use identity-aware and behaviour-aware controls to decide whether a data action is legitimate in context.

Threat narrative

Attacker objective: The practical objective is unintended data acquisition and reuse by systems outside the enterprise control boundary, whether or not a malicious attacker is involved.

1. Entry occurs when employees paste proprietary code, customer data, or regulated information into chatbots, copilots, or SaaS tools that were not approved through security review.
2. Credential or policy control does not stop the flow because the interaction is legitimate from the employee's perspective but outside enterprise governance and retention control.
3. Impact follows when the organisation loses visibility into how the external AI system retains, processes, or reuses the data, creating exposure to compliance, IP, and reputational harm.

Breaches seen in the wild

• Samsung ChatGPT leak 2023: Samsung staff pasted chip source code and meeting notes into ChatGPT weeks after it was allowed, leading Samsung to restrict generative AI tools.
• OmniGPT breach claim 2025: A hacker claims to have leaked 34 million OmniGPT AI chat messages holding users' API keys and credentials; OmniGPT has not confirmed it.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Policy-based DLP is colliding with a control-plane problem, not just a detection problem. The article shows that static rules fail when data is transformed inside conversational systems rather than moved as a clean file or email. That means the governance model has to shift from post-event inspection to decisioning at the point of use. Practitioners should read this as a data-governance and identity boundary issue, not merely a DLP tuning issue.

Shadow AI creates a retention trust gap that legacy controls were never designed to close. Once sensitive information enters an unmanaged AI service, the organisation loses reliable control over retention, reuse, and downstream processing. This is especially relevant where employees adopt AI tools for productivity rather than malice, because the risk is operationally normalised before security teams see it. The field needs policies that assume external AI systems are part of the data path, not exceptions to it.

Context-aware protection is becoming the named capability that matters here. The article points toward a model that combines classification, behavioural signals, and business intent, which is a more precise response than relying on keywords or pattern libraries alone. For NHIMG, the critical implication is that governance must understand where identity, application trust, and data sensitivity intersect. Security teams should treat AI access and data handling as one policy problem.

Shadow AI should be governed as an identity and access issue as much as a data issue. Employees are making real-time decisions about which tools receive sensitive information, and those decisions bypass formal review when sanctioned workflows are missing or too slow. That creates a control gap between user convenience and enterprise authority. The practical conclusion is that AI usage, data handling, and approved application boundaries need shared governance.

Adaptive data protection is the only durable response to AI-mediated data movement. The article is right to dismiss more static policy layers as the answer, because the underlying problem is not rule scarcity but environment volatility. AI changes the shape of the workflow faster than manual policy maintenance can track. Organisations should therefore design governance that can classify, contextualise, and constrain data actions in motion.

From our research library:

• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
• Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
• Read next: Shadow AI and AI Agent Discovery Guide

What this signals

Shadow AI turns DLP into a governance problem. The practical issue is no longer just whether a payload matches a rule. It is whether the organisation can still assert control over who can send sensitive data into an external AI system, what that system does with it, and how long the content persists. Teams that still treat AI use as an app-control edge case will miss the real boundary shift.

Context-aware protection is the right design direction for AI-era data movement. A workable programme links data classification, user identity, device trust, and destination risk before a prompt or upload is allowed. That aligns better with modern collaboration patterns than keyword-only inspection ever could, and it gives security teams a clearer basis for policy enforcement.

43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases. That concern is a useful signal that organisations are already thinking beyond exfiltration and toward reuse risk, which is exactly where legacy DLP becomes weakest.

For practitioners

• Define approved AI data paths Map which AI tools, copilots, and SaaS platforms may receive sensitive data, then publish explicit handling rules for each approved path.
• Classify data before it reaches AI systems Apply sensitivity labels and content categories upstream so the organisation can decide whether code, customer data, or regulated information may be shared.
• Tie AI use to identity and session context Use user identity, device trust, and session risk to decide whether a prompt, upload, or share action should be allowed in real time.
• Replace static DLP rules with behavioural controls Add detection for abnormal sharing patterns, repeated prompt uploads, and unusual SaaS destinations instead of relying only on keywords and regex.
• Review retention and contractual terms for AI services Require clear terms for data retention, reuse, and deletion before sensitive content can be processed by external AI platforms.

Key takeaways

• Policy-based DLP was built for predictable data movement, while shadow AI and SaaS workflows now reshape information inside systems the enterprise does not fully control.
• The article’s core warning is that visibility, retention, and reuse become uncertain once sensitive data enters external AI services, even when the initial user action looks routine.
• Security teams need context-aware controls that combine classification, identity context, and behavioural signals if they want to govern AI-era data movement without simply blocking it.

Key terms

• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Policy-based DLP: Policy-based DLP is a traditional data loss prevention model that uses predefined rules, patterns, and inspection points to detect or block sensitive data movement. It works best in predictable environments, but loses accuracy when data flows become conversational, embedded, or highly dynamic.
• Context-aware protection: Context-aware protection is a data security approach that evaluates the sensitivity of content together with who is sharing it, where it is going, and whether the action fits normal business behaviour. It replaces simple pattern matching with runtime judgement, which is essential for AI-driven workflows.
• Retention trust gap: A retention trust gap is the uncertainty that arises when an organisation cannot verify how long an external system keeps submitted data or how that data may later be reused. In AI workflows, this gap becomes a direct issue for compliance, confidentiality, and control.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, human identity, identity lifecycle, and secrets management. It helps security and identity practitioners connect governance decisions to the controls that support them.