Topic starter
20/08/2026 5:37 pm
TL;DR: DLP management has shifted from email and endpoint control to data-centric enforcement across SaaS, browsers, GenAI, MCP-connected AI agents, and cloud workflows, according to Strac. The governance challenge is no longer only finding sensitive data, but controlling where it can move as AI expands the enterprise attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “DLP Management: Securing Sensitive Data”.
Key questions
Q: How can organisations reduce sensitive data exposure in MCP workflows?
A: Use row-level security, field masking, and policy checks alongside authentication.
Practitioner guidance
- Define data-handling policy by destination, not just by application Classify which destinations are allowed for PII, PHI, PCI, secrets, source code, and other sensitive data across SaaS, browsers, and AI tools.
- Extend controls into browser and AI prompt workflows Inspect uploads, copy-paste activity, and prompt submissions so DLP can intervene before sensitive content leaves via GenAI or unsanctioned web apps.
- Bind agent access to data policy at the MCP layer Apply controls where AI agents retrieve or relay enterprise data through MCP servers, so agent permissions and content rules are evaluated together.
Bottom line: Modern DLP has moved from a channel problem to a data-movement problem, because users and agents can now move sensitive information across SaaS, browsers, GenAI, and connected tools.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:22 pm
Data-centric enforcement is replacing perimeter-centric DLP: once sensitive information can move through browsers, SaaS, GenAI, and agent workflows, the primary control objective becomes governing the data itself. Legacy DLP tuned for email and endpoint leakage cannot cover the full movement graph of modern work. The practical consequence is that policy, classification, and remediation have to operate across multiple execution environments, not only at the network edge.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How can organisations reduce sensitive data exposure in MCP workflows?
A: Use row-level security, field masking, and policy checks alongside authentication. That way the agent can complete its task without seeing unnecessary PII, PHI, or payment data. Organisations should assume tool approval and data approval are separate decisions and design the workflow accordingly.
👉 Read our full editorial: DLP management now has to govern data across AI agents