Topic starter
25/08/2026 9:13 am
TL;DR: Sensitive data security now depends on discovering, classifying, and governing access across users, systems, and AI workflows, because 90% of organisations have exposed sensitive cloud data and 40% of files uploaded to generative AI tools contain PII or PCI data, according to Commvault. The practical shift is that data visibility, not perimeter control, now determines whether identity and access governance can actually reduce exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “How to Protect Your Most Sensitive Data: A Guide to Data & AI Security”.
By the numbers:
- 90% of organizations have exposed sensitive cloud data that can be surfaced by AI, according to Commvault.
- 40% of files uploaded into generative AI tools contain Personal Identifying Information or PCI data, according to Commvault.
Key questions
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: Why do over-permissive service accounts increase risk in regulated environments?
A: Over-permissive service accounts turn a single machine identity into a broad trust anchor across multiple systems.
Q: What breaks when organisations do not know where sensitive data is stored?
A: Identity controls lose their target.
Practitioner guidance
- Implement enterprise-wide sensitive data discovery Inventory structured, semi-structured, and unstructured data across cloud platforms, SaaS applications, endpoints, and shared repositories before expanding AI use cases.
- Classify data before AI training or prompt ingestion Block or redact PII, PCI, PHI, secrets, and other regulated content before it enters training sets, embeddings, or runtime prompts.
- Extend access reviews to service accounts and AI systems Review non-human identities alongside users so overpermissive access, drift, and stale entitlements are captured in the same governance cycle.
Bottom line: The article’s central risk is not data volume alone, but the inability to find, classify, and govern sensitive information before it spreads across cloud and AI workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 9:14 am
Data visibility is now the control boundary, not a supporting control. Perimeter tools cannot govern what they cannot find, and that is why discovery and classification sit ahead of access policy in any serious data programme. In cloud and AI estates, this becomes a governance issue as much as a security one. Practitioners should treat incomplete discovery as a direct limitation on control effectiveness, not as an acceptable coverage gap.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: How should organisations respond when sensitive data starts flowing into AI pipelines?
A: Treat AI pipeline exposure as a governance boundary change, not just a storage issue. Reclassify the risk, check whether the data can be accessed by copilots or automation, and tighten policy where necessary. The key is to control movement before the pipeline turns sensitive data into operational input.
👉 Read our full editorial: Data and AI security depends on classification and access governance