Topic starter
14/08/2026 6:36 pm
TL;DR: Traditional DLP assumes file transfers through known channels, but AI tools such as ChatGPT, Cursor, and autonomous agents move data through prompts, workflows, and integrations without classic upload or download events, according to Orion. The control gap is now a threat-modeling problem: teams need to map AI-specific data flows before they can govern them effectively.
Editorial analysis by NHI Mgmt Group, based on content published by Orion: “How AI Broke the Data Protection Threat Model”.
Key questions
Q: What breaks when traditional DLP is applied to AI prompt flows?
A: Traditional DLP breaks when it relies on upload, download, or attachment events that AI systems never create.
Q: Why do AI agents create new data loss risk even when files are not transferred?
A: AI agents can retrieve, transform, and forward information under delegated authority without a visible file movement event.
Q: What are the signs that data and AI governance is not working as intended?
A: Common warning signs include poor data classification coverage, unidentified cookies or trackers, duplicate files that remain unaddressed, and difficulty mapping AI system components and dependencies.
Practitioner guidance
- Model AI-specific data flows Map prompts, retrievals, summaries, and agent actions as end-to-end data paths so teams can see where sensitive content actually travels.
- Classify AI interaction surfaces Identify which AI tools, copilots, agents, and connectors can ingest regulated or confidential data, then assign control ownership for each surface.
- Review delegated access for agents Check which service accounts, API keys, and connected tools allow an AI system to move or summarise information on behalf of a user.
Bottom line: Traditional DLP misses prompt-driven AI flows because the sensitive data can move without the file events those controls were built to detect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:43 pm
AI data loss is now a control-mapping problem, not just a prevention problem. The article shows that teams are still trying to block outcomes without first understanding the pathways. That is a governance failure because controls cannot be validated against flows they have not modelled. The right starting point is not more policy noise, but a clear view of where prompts, agents, and integrations move sensitive data.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI data flows that bypass traditional DLP channels?
A: Start by mapping the full path from prompt to output, including connectors, service accounts, and any delegated access behind the scene. Then place controls at the points where data is interpreted, transformed, or forwarded, because those are the moments when AI creates loss paths that classic file-based DLP cannot see.
👉 Read our full editorial: AI data loss outpaces traditional DLP models in prompt-driven flows