Zero trust for AI and data-centric control - are your controls keeping up?

TL;DR: Traditional Zero Trust frameworks were built for human users and static systems, but AI agents move across platforms, handle sensitive data in seconds, and can outpace controls that rely on identity checks alone, according to Cyera. Data-centric enforcement is now the practical boundary because access governance at human speed cannot reliably govern machine-speed behaviour.

NHIMG editorial — based on content published by Cyera: Rethinking Zero Trust in the Age of AI

Questions worth separating out

Q: How should security teams govern AI systems under Zero Trust?

A: Security teams should govern AI systems at the data layer as well as the identity layer.

Q: Why do traditional Zero Trust controls struggle with AI agents?

A: Traditional Zero Trust controls struggle because they assume access can be verified and then monitored through stable human-oriented patterns.

Q: What do teams get wrong about least privilege in AI environments?

A: Teams often focus on data access and ignore action scope.

Practitioner guidance

• Map data before you map AI access Inventory where sensitive data resides, which AI systems can reach it, and which workflows can move it across boundaries.
• Define least agency for every AI workflow Document the exact actions an AI system may take, not only the data it may see.
• Bind monitoring to data movement events Alert on unauthorized prompts, unexpected transformations, and abnormal sharing patterns instead of relying only on authentication logs.

What's in the full article

Cyera's full article covers the operational detail this post intentionally leaves for the source:

• How Cyera positions DSPM and AI-SPM together across cloud, SaaS, and hybrid environments
• The article's own walkthrough of data-layer monitoring and policy enforcement concepts for AI workflows
• Cyera's explanation of how its platform links AI activity to the data it touches
• The source article's examples of prompt, sharing, and movement controls for AI systems

👉 Read Cyera's analysis of Zero Trust for AI and data-centric enforcement →

Zero trust for AI and data-centric control - are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →