Topic starter
25/06/2026 10:27 pm
TL;DR: Boards are increasingly treating AI strategy and data protection as one governance problem because AI systems retrieve whatever they can access, and a joint study cited in the source found 96% of enterprise permissions go unused while 91% of sensitive data accessible to workers is untouched, according to Cyera. That makes visibility, access mapping, and control of dormant access the prerequisite for safe AI adoption, not a downstream cleanup task.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Why Boards Are Asking About AI and Data in the Same Breath”.
Key questions
Q: What breaks when AI agents are given broad inherited permissions?
A: Broad inherited permissions break the assumption that access is tied to a narrow business need.
Q: Why do boards now treat AI strategy and data security as one issue?
A: Because AI value depends on data reach, and data reach depends on governance.
Q: How should security teams handle shadow AI on corporate endpoints?
A: Treat it as an identity governance issue, not just an endpoint hygiene issue.
Practitioner guidance
- Map AI-connected access paths Identify every copilot, retrieval pipeline, agent, lab tool, and connected identity that can reach enterprise data.
- Classify data before enabling AI workflows Determine which datasets are sensitive, regulated, or operationally critical before attaching them to AI use cases.
- Reduce dormant permissions that AI can inherit Review broad worker access and remove entitlements that are no longer justified.
Bottom line: AI governance fails when enterprises treat retrieval systems as if they were passive consumers, because they can only work within the access already in place.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:59 pm
Data visibility has become the prerequisite control for AI governance: the board is no longer asking whether AI can be adopted, but whether its data reach can be explained before deployment. That is a governance shift, not a tooling preference. The old model assumed AI would sit behind known access boundaries; the new model assumes AI will traverse whatever the enterprise has already exposed. Practitioners should treat data visibility as the foundation for safe adoption, not a downstream reporting layer.
A few things that frame the scale:
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: What is the difference between identity control and data classification in cloud AI governance?
A: Identity control governs who or what can access cloud resources and data. Data classification determines what the data is, how sensitive it is, and which handling rules should apply. In AI governance, the two work together. Classification informs access decisions, while identity controls enforce them. Without both, organisations struggle to balance secure innovation with usable cloud operations.
👉 Read our full editorial: AI and data security are now the same boardroom question