Notifications
Clear all
Topic starter
02/08/2026 11:41 am
TL;DR: 70% of organizations struggle to enforce policies on GenAI tools, exposing a gap between visibility and real-time control as AI systems continuously access and transform data, according to Mind’s The Impact of Data Trust on AI Success. The decisive issue is no longer whether teams can see AI risk, but whether policy can be enforced inside the flow of AI activity.
NHIMG editorial — based on content published by Mind: Data Trust + AI Success, why seeing AI risk isn't enough to protect you from it
By the numbers:
- 70% of organizations report difficulty enforcing policies on GenAI tools.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams handle AI interactions that can expose sensitive data in real time?
A: Security teams should enforce policy before the AI action completes, not after the event is logged.
Q: Why do AI agents expose gaps in existing IAM models?
A: AI agents expose gaps because they do not fit the assumption that access can be assigned once and then managed through periodic reviews.
Q: What breaks when organisations rely only on observability for AI governance?
A: Observability breaks at the point where action is needed, because it records the event after the response has already been generated or delivered.
Practitioner guidance
- Map AI systems to the identities they actually use Build an inventory of service accounts, API keys, tokens, and connector credentials tied to GenAI tools and agents, then classify each by scope, lifespan, and data reach.
- Move policy enforcement into the data path Apply controls where prompts, retrieval, outputs, and exports occur so the policy decision happens during use rather than after the event.
- Reduce standing privilege on AI-connected identities Remove broad, persistent access from the credentials that support AI workflows and replace it with narrowly scoped, task-based permission sets.
What's in the full article
Mind's full blog covers the operational detail this post intentionally leaves for the source:
- Specific examples of where enforcement breaks across endpoints, SaaS, and AI workflows
- Direct CISO quotes on the gap between policy design and runtime control
- The full research framing behind the Data Trust + AI Success series
- Operational detail on the controls MIND says are holding up in production
👉 Read Mind's analysis of why AI risk visibility is not enough →
AI risk visibility vs enforcement: what security teams need now?
Explore further
02/08/2026 12:53 pm
Visibility without enforcement is a governance illusion. Security teams can map AI usage and still fail to control what those systems do with data in motion. That is the core break in many AI programmes: policy exists, but the enforcement layer is too slow, too manual, or too detached from execution. For identity teams, this is a runtime governance problem, not a documentation problem.
A question worth separating out:
Q: Who is accountable when an AI system moves data outside policy?
A: Accountability should sit with the team that owns the AI workflow, the data it touches, and the credentials that enable it. If governance stops at authentication, ownership becomes blurred. Clear accountability means mapping the data path, the action scope, and the approving function before deployment.
👉 Read our full editorial: AI policy enforcement fails when visibility outruns control
