Topic starter
02/01/2026 11:15 am
TL;DR: At DataSecAI25, more than 1,000 data, security, AI, privacy, and engineering leaders converged on a common theme: AI governance is shifting from an obstacle to an operating control, because visibility into data, identity, and access is now the prerequisite for safe AI adoption, according to Cyera. That shift makes unmanaged AI usage, shadow AI, and agent oversight problems for IAM and NHI programs, not just data teams.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “What DataSecAI 2025 Revealed About the Future of Data, Security, and AI”.
Key questions
Q: How should security teams govern shadow AI without slowing adoption?
A: Start with continuous discovery, then classify tools by data access, system connectivity, and provider trust.
Q: Why does shadow AI create an identity governance problem?
A: Shadow AI creates an identity governance problem because unapproved tools and agents can access enterprise data without being inventoried, owned, or recertified.
Practitioner guidance
- Establish unified visibility for AI workflows Correlate data classification, identity subject and access path before approving or expanding any AI use case.
- Extend lifecycle controls to shadow AI use Inventory personal accounts, unsanctioned tools and delegated workflows that touch sensitive data, then route them through the same approval and offboarding logic used for governed identities.
- Shift agent oversight to runtime enforcement Monitor agent activity continuously for anomalous access, runaway loops and policy drift, and constrain execution at the point of action rather than relying on after-the-fact review.
Bottom line: AI governance is becoming an operational control because organisations need visibility into data, identity and access before they can govern AI safely.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:29 pm
AI governance is becoming an access control problem, not just a data policy problem. The article shows that organisations now need to know what data exists, who can reach it and which identities are exercising that access before AI can be governed safely. That shifts the centre of gravity from documentation to operational control. For practitioners, the important change is that governance now lives inside entitlement decisions and access paths, not around them.
A question worth separating out:
Q: Why do organisations still need human review in AI-driven document processing?
A: Human review remains necessary when accuracy, context, or regulatory impact make automation riskier than manual checks. OCR and LLM pipelines can misread handwriting, hallucinate values, or miss layout-sensitive fields. A reviewer catches exceptions, validates critical fields, and provides labelled corrections that improve the model while preserving accountability for high-risk documents.
👉 Read our full editorial: DataSecAI25 shows AI governance is becoming an operational control