Topic starter
18/08/2026 2:47 pm
TL;DR: 2026 will likely bring major AI-driven breaches, more convincing phishing, and faster growth in shadow AI and unclassified data as organisations expand genAI and agentic AI use, according to Ground Labs. The practical shift is clear: data governance and DSPM now sit alongside breach prevention as core control layers, especially where identity, access, and AI usage intersect.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Data security predictions 2026”.
Key questions
Q: What breaks when data governance is used as a substitute for AI agent identity controls?
A: What breaks is accountability.
Q: Why do shadow AI and unclassified data increase breach risk?
A: Shadow AI and unclassified data increase risk because security teams cannot apply controls reliably to assets they have not discovered or classified.
Q: How should security teams govern data access for agentic AI workflows?
A: Security teams should treat data access as part of the agent’s decision boundary, not as a separate storage problem.
Practitioner guidance
- Map AI usage to data discovery Inventory where employees and services are using genAI tools, then connect those usage paths to data discovery and classification so sensitive data does not disappear into unmanaged workflows.
- Classify prompt and output data Treat prompts, uploaded files, and AI-generated outputs as governed data classes, with retention, access, and monitoring rules based on sensitivity rather than tool convenience.
- Review delegated access for AI workflows Check which accounts, tokens, and service identities can call AI tools or move data between systems, and reduce privilege wherever the workflow does not need broad access.
Bottom line: AI adoption is expanding the number of data paths that security teams must discover and classify before they can govern them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:29 pm
Data governance is becoming an identity problem as much as a data problem. The article is right to treat visibility, classification, and access control as linked controls rather than separate programmes. Once AI tools ingest sensitive content, identity decisions determine who can reach that data, who can move it, and who can review those paths. Practitioners should therefore treat data governance and IAM as a shared control surface, not adjacent disciplines.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What signals show that AI access is outpacing governance?
A: The clearest signals are broad inherited permissions, large volumes of stale guest access, and inconsistent file classification across teams. If remediation is happening only after AI rollout, the programme is reacting to exposure rather than controlling it.
👉 Read our full editorial: AI breach pressure and data governance will define 2026