Notifications
Clear all
Topic starter
20/08/2026 5:37 pm
TL;DR: DLP management has shifted from email and endpoint control to data-centric enforcement across SaaS, browsers, GenAI, MCP-connected AI agents, and cloud workflows, according to Strac. The governance challenge is no longer only finding sensitive data, but controlling where it can move as AI expands the enterprise attack surface.
NHIMG editorial — based on content published by Strac: DLP Management: Securing Sensitive Data
Questions worth separating out
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: Why do AI agents make data loss prevention harder to govern?
A: AI agents can move data at machine speed, repeat mistakes across many records, and operate through multiple tools in one session.
Q: What do security teams get wrong about DLP?
A: The common mistake is assuming DLP can fix excessive access after the fact.
Practitioner guidance
- Define data classes that trigger enforcement Create policy tiers for PII, PHI, PCI, credentials, secrets, source code, and customer records so DLP actions can be matched to sensitivity rather than applied uniformly.
- Instrument browser and GenAI egress points Inspect copy-and-paste, upload, and prompt activity in browsers and AI tools so sensitive information can be blocked, redacted, or coached before it leaves an approved context.
- Treat MCP workflows as data transfer paths Review AI agent integrations that use MCP and add controls at the point where agents retrieve, transform, or forward information between connected systems.
What's in the full article
Strac's full article covers the operational detail this post intentionally leaves for the source:
- Specific DLP enforcement actions such as redaction, masking, blocking, quarantine, deletion, and encryption in SaaS and browser workflows
- Content-aware detection methods for files, screenshots, images, attachments, and prompts, including OCR and machine learning
- How MCP DLP is positioned between AI agents and connected enterprise tools to inspect data in motion
- Practical examples of combining DSPM discovery with DLP remediation across cloud, endpoint, browser, and GenAI environments
👉 Read Strac's analysis of DLP management across SaaS, GenAI, and AI agents →
DLP management across GenAI and AI agents: what changes now?
Explore further
20/08/2026 6:22 pm
Data-centric DLP is now an identity governance issue: once users, applications, and AI agents can all move sensitive information, DLP stops being a narrow content-control problem and becomes part of access governance. The important question is no longer only whether a subject can authenticate, but whether the subject should be allowed to move a given data class into a given destination. That is where identity, privilege, and data sensitivity converge. Practitioners should treat DLP policy as an extension of access policy.
A question worth separating out:
Q: How can security teams tell whether DLP is actually working for AI agents?
A: Look for evidence of endpoint coverage, workflow correlation, and data lineage. If the team cannot see local agent activity, reconstruct the sequence of reads and writes, or distinguish legitimate testing from real exfiltration, then the DLP program is only covering a subset of the risk.
👉 Read our full editorial: DLP management now has to govern data across AI agents
