Topic starter
10/06/2026 12:22 am
TL;DR: Traditional cyber security tools struggle with LLMs because conversational context, hidden entry points, and model-side execution do not fit browser security, DLP, or DSPM assumptions, according to Lasso Security. Existing controls were built for static systems and known data flows, while LLM security now needs identity, context, and interaction-aware governance.
Editorial analysis by NHI Mgmt Group, based on content published by Lasso Security: “Can Common Cyber Security Tools Handle Large Language Model Risks?”.
Key questions
Q: What breaks when traditional security tools are used to govern LLMs?
A: They break at the point where the security problem becomes conversational rather than transactional.
Q: Why do LLM applications create new data leakage risks for identity teams?
A: LLM applications can expose sensitive data when users paste secrets, when agents retrieve privileged context, or when responses echo internal material back to users.
Q: What are the signs that an LLM is failing basic governance controls?
A: Warning signs include inconsistent responses to similar prompts, weak refusal behavior, uncontrolled exposure of sensitive inputs, and poor visibility into post-deployment activity.
Practitioner guidance
- Map every LLM entry point Inventory browser use, embedded third-party apps, internal tools and API-connected models so the security team knows where LLM interaction actually occurs.
- Define model-level authorisation boundaries Specify which data, tools and downstream actions each LLM use case may reach, including plugin execution and backend calls that never appear in the browser.
- Replace pattern-only monitoring with contextual detection Tune controls to watch for prompt manipulation, multi-turn coercion and unexpected output behaviour rather than relying only on keywords, regexes or fixed data labels.
Bottom line: Traditional browser, DLP and DSPM controls do not fully address LLM risk because the real security boundary is conversational and often extends beyond the visible interface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/06/2026 2:07 am
LLM security exposes a control mismatch, not just a tooling gap. Browser security, DLP, and DSPM each solve a narrower problem than LLM governance requires. The article shows that the risk sits in the interaction layer, where users, prompts, data, and tool execution meet. Practitioners should stop treating LLMs as if they were ordinary web sessions or static data repositories.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How can teams decide whether an LLM needs stricter governance?
A: Start with the data it can access, the tools it can call, and whether its responses can influence internal workflows. The more an LLM can read, generate, or trigger inside business systems, the more it belongs under identity, logging, and access governance rather than only content filtering.
👉 Read our full editorial: Traditional cyber security tools fall short for LLM risk
12/06/2026 3:41 am
Static security controls fail because LLM risk is interactive, not merely informational. Browser security, DLP and DSPM each inspect a different slice of the problem, but none was designed to govern conversational systems whose behaviour depends on prompt context, hidden execution paths and model output. The central failure is not tool coverage alone, but the assumption that inspection of content or endpoints is enough to control an LLM. Practitioners need to treat LLMs as governed interaction surfaces, not just data sinks.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams separate DLP, DSPM and LLM governance?
A: Use DLP for detecting sensitive content in motion, DSPM for discovering and classifying data at rest, and LLM governance for controlling prompts, outputs, tool calls and model context. Those are complementary layers, not substitutes. Without the LLM layer, the other two leave a semantic gap.
👉 Read our full editorial: Traditional cyber security tools fall short for LLM risk
This post was modified 7 hours ago by NHI Mgmt Group