Topic starter
04/06/2026 6:48 pm
TL;DR: AI tools are already moving 84 percent of enterprise data, and nearly 72 percent of those tools are classified as high or critical risk, according to Cyera's AI Security for Dummies special edition. The governance gap is not the model itself but the data and access paths AI can reach, which makes data-first controls the practical starting point.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “The AI Worked Perfectly. That Was the Problem.”.
By the numbers:
- 84 percent of enterprise data is already flowing through AI tools.
- nearly 72 percent of those tools are classified as high or critical risk.
Key questions
Q: How should teams govern AI agent access to production data?
A: Treat agent actions as runtime events that need policy checks at execution time, not just pre-approved credentials.
Q: Why do AI systems create identity risk as well as model risk?
A: Because AI systems rarely act alone.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Inventory all AI access paths Identify public AI, embedded AI, and homegrown AI across business units, then document which data sources each one can reach.
- Classify the data each AI system can touch Map documents, databases, email, and APIs to sensitivity tiers so access policy reflects the actual exposure surface.
- Require proof artifacts before approving production use Make audit logs, data lineage, and accountability evidence part of the release gate for any AI system with enterprise data access.
Bottom line: AI security becomes a data access problem the moment assistants can reach sensitive enterprise sources.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 7:02 pm
Data access is the real AI security control plane: Once an AI assistant can query documents, databases, email, and APIs, model-centric security stops being the primary issue. The exposure happens at the point where retrieval meets authorisation, because the system can faithfully return data the requester was never meant to see. Practitioners should treat AI access as a governed entitlement problem, not a prompt problem.
A question worth separating out:
Q: Should AI security be managed separately from IAM and data protection?
A: No. AI security becomes practical only when it is absorbed into existing identity and data governance. The same entitlement reviews, access approvals, and data classification rules that govern other sensitive systems need to apply to AI retrieval paths as well.
👉 Read our full editorial: AI security starts with data access, not model control