Notifications
Clear all
Topic starter
18/08/2026 2:28 pm
TL;DR: Enterprise employees are already sending sensitive data into public AI tools, and Seclore cites research showing 68% are not following policy while one in twelve prompts contains confidential information. The control problem is no longer whether AI is allowed, but whether data can be masked, logged, and governed before it reaches the model.
NHIMG editorial — based on content published by Seclore: The Debate About AI in the Enterprise Is Over. Here Is the Only Question That Matters
By the numbers:
- 68 percent of enterprise employees are not following policy when asked not to share sensitive data with external AI tools.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should security teams govern AI prompts that include sensitive data?
A: Treat the browser as a control point, not just an interface.
Q: Why do legacy DLP tools struggle with AI workflows?
A: Legacy DLP was built for files, email, and pattern matching, not for free-form prompts, embedded copilots, or agentic connections.
Q: What do organisations get wrong about AI data retention?
A: They often assume retention is an operational setting rather than a security decision.
Practitioner guidance
- Define the context window as a policy boundary Classify the prompt layer as a governed data-handling surface and require controls before data is submitted to a model.
- Mask sensitive values before model submission Use tokenization or equivalent masking for confidential fields that do not need to be exposed to the model.
- Extend governance to AI and NHI submission identities Treat users, applications, and AI agents that send prompts as separate policy subjects.
What's in the full article
Seclore's full blog post covers the operational detail this post intentionally leaves for the source:
- How the tokenization layer handles sensitive values in the context window without exposing the original data
- What the AI governance logging records for each interaction, including user, policy, and model metadata
- How the portal and API deployment options differ for enterprise integration and policy enforcement
- Which regulated data classes and residency constraints the product claims to address at the architecture level
👉 Read Seclore's analysis of AI context-window data protection and governance →
AI context window protection: what security teams need to govern?
Explore further
18/08/2026 3:16 pm
AI context-window governance is now a data-security discipline, not a productivity feature. The article is right to treat the prompt layer as a control point because AI has changed where sensitive data is exposed. Existing DLP assumptions break when the destination is not a file, mailbox, or endpoint but a reasoning engine that consumes context in real time. Practitioners should treat prompt-time protection as a new operational boundary for data governance.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: AI context-window security is now the enterprise control point
