Topic starter
18/08/2026 2:34 pm
TL;DR: Payments firms are pushing AI into fraud, support, and risk workflows, but Securiti argues that weak data visibility, overprovisioned access, and poor governance still block safe scale. The practical issue is not model adoption alone, but whether sensitive data, entitlements, and compliance controls can keep pace with AI-driven operations.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “DataAI Security for Payments Companies”.
Key questions
Q: How should security teams govern AI access to sensitive financial data?
A: They should combine identity governance with data classification so access decisions reflect both who is acting and what data is involved.
Q: Why do overprovisioned entitlements make AI risk worse in payments?
A: Because AI systems can amplify the effect of access that would already be risky for a human operator.
Q: What are the signs that AI governance is failing in a payments programme?
A: Common signals include unknown data stores feeding AI, excessive access across teams, inconsistent masking rules, and manual exceptions that nobody can explain during audit.
Practitioner guidance
- Implement unified data discovery and classification Map sensitive payment data across multicloud, SaaS and operational systems before allowing AI workflows to consume it.
- Review AI entitlements as combined access paths Assess users, groups, machines and datasets together so toxic combinations can be removed before an AI workflow goes live.
- Apply masking and sanitization to AI inputs Use row-level filtering, dynamic column masking and sanitisation for the records that copilots and agents can reach.
Bottom line: Payments AI becomes unsafe when sensitive data, entitlements and compliance controls are managed separately.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:20 pm
Data visibility has become the gating control for AI in payments: if teams cannot inventory sensitive data and trace how it flows into AI systems, they cannot prove that those systems are safe to operate. That is especially true in payments, where transaction, fraud and customer data often sit across multiple clouds and SaaS services. The practitioner conclusion is straightforward: AI governance starts with discoverability, not with model approval.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should payments firms prioritise data minimization before expanding AI use cases?
A: Yes, when sensitive records are duplicated, stale or broadly exposed, minimization should come first. Reducing the data footprint narrows the blast radius, improves compliance evidence and makes downstream AI controls easier to enforce. In regulated environments, less exposed data usually means less operational and governance risk.
👉 Read our full editorial: AI agent governance in payments depends on data controls