Topic starter
14/07/2026 4:22 pm
TL;DR: Eighty-five percent of organisations experienced at least one data loss incident in the past year, careless users drove 58% of cases, and just 1% of users accounted for 76% of data loss events, showing how human behaviour, sprawl, and AI are reshaping exposure, according to Proofpoint’s 2025 Data Security Landscape report. The governance problem is no longer only data classification but controlling who and what can move sensitive data at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Proofpoint: “Insiders, AI, and data sprawl converge: essential insights from the 2025 Data Security Landscape report”.
By the numbers:
- 85% of organizations experienced at least one data loss incident in the past year.
- Just 1% of users accounted for 76% of data loss events.
- Over 29% of organizations saw their data increase by 30% or more in the past year.
Key questions
Q: What breaks when AI agents can move sensitive data through MCP without strong controls?
A: Security teams lose the ability to govern data movement at the point of transfer, which means discovery-only monitoring arrives too late.
Q: Why do over-scoped AI and service permissions increase data-loss risk?
A: Over-scoped permissions increase risk because they let non-human actors reach more data than the workflow requires, which expands the blast radius of a mistake or compromise.
Q: How do security and data teams know whether governance controls are actually working?
A: They should test whether metadata changes, ownership updates and discovery signals are reflected consistently across both the governance platform and the cloud environment.
Practitioner guidance
- Map who and what can move sensitive data Build an inventory of human users, service accounts, and AI agents that can read, copy, forward, or transform sensitive information across email, SaaS, and cloud services.
- Prioritise behaviour-based controls for top-risk users Use user and entity behaviour analytics to identify the small subset of accounts responsible for the highest share of risky movement and exfiltration attempts.
- Scope AI agent access to the task boundary Limit non-human credentials to the smallest data set and shortest session needed for the workflow, then audit the downstream destinations they can reach.
Bottom line: Data security is now shaped by data sprawl, human behaviour, and AI agents that can all move sensitive information at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 4:30 pm
Data security has become an identity governance problem disguised as a content problem. Once sensitive information is distributed across cloud, SaaS, email, and AI-mediated workflows, the critical question is no longer only where the data sits but who and what can move it. That makes human identity, service identity, and emerging AI agent identity part of the same control surface. Practitioners should treat movement rights as a governed entitlement, not just a data policy issue.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations create separate policies for AI agents and human users?
A: Yes. Human users, customer agents, and internal service identities have different lifecycle, risk, and assurance requirements. A single policy set usually overgeneralises and either blocks useful automation or leaves software actors over-privileged. Separate policy treatment makes ownership, scope, and auditability much clearer.
👉 Read our full editorial: AI agents and data sprawl are reshaping enterprise data security