Notifications
Clear all
Topic starter
19/08/2026 3:26 pm
TL;DR: Verizon’s 2026 Data Breach Investigations Report, published by Sentra, finds Shadow AI is now the third most common insider DLP event, third-party breaches rose 60% to 48% of all breaches, and vulnerability exploitation drove 31% of incidents, showing that data exposure is increasingly governed by visibility gaps rather than isolated technical failures. The decisive control problem is knowing what sensitive data exists, where it lives, and who can reach it before AI, vendors, or attackers do.
NHIMG editorial — based on content published by Sentra: 2026 DBIR analysis through an AI data readiness lens
By the numbers:
- Verizon’s 2026 DBIR covers more than 22,000 confirmed breaches and 31,000 total incidents in the twelve months ending October 2025.
- Third-party breaches now account for 48% of total breaches, up 60% year over year.
- Vulnerability exploitation accounted for 31% of data breaches in the study period.
Questions worth separating out
Q: How should security teams govern employee use of public AI tools in the browser?
A: They should treat browser AI use as an identity and data-control problem, not just an acceptable-use issue.
Q: Why do third-party breaches remain so difficult to reduce?
A: They remain difficult because many programmes assess vendor security posture without continuously validating what data the vendor can actually reach.
Q: How can organisations prioritise vulnerabilities using data context?
A: They should score exposures by the sensitivity of the data protected by the affected asset, not by technical severity alone.
Practitioner guidance
- Classify sensitive data before AI access expands Map the datasets employees can reach, then classify the records that should never be exposed to external AI systems or unmanaged browser-based tools.
- Review third-party entitlements against actual data reach List every vendor, API, and shared service that can touch sensitive records, then verify whether the access is still required and properly scoped.
- Enrich remediation with data sensitivity context Add sensitivity labels, ownership, and identity reach to vulnerability and misconfiguration queues so teams can rank exposures by business impact.
What's in the full article
Sentra's full article covers the operational detail this post intentionally leaves for the source:
- Sentra's breakdown of how AI data readiness maps to Shadow AI, third-party risk, and vulnerability prioritisation in practice.
- The article's explanation of how continuous data classification changes remediation timing and access decisions across cloud, SaaS, and on-prem environments.
- Practical examples of how overexposed data becomes a governance issue rather than a single DLP alert.
- The source's full framing of how AI data readiness fits into broader enterprise security operations.
👉 Read Sentra’s analysis of the 2026 DBIR through an AI data readiness lens →
AI data readiness and the governance gap teams are missing?
Explore further
19/08/2026 4:10 pm
AI data readiness is now an identity governance problem, not just a data governance problem. The DBIR’s Shadow AI finding shows that employees are already moving sensitive data through sanctioned identities and unsanctioned services. That means the access problem starts with what a user can reach, not only with what they later leak. IAM, IGA, and data governance must be treated as one operating model, because classification without entitlement control still leaves data reachable. Practitioners should treat AI usage as an entitlement decision, not a content-filtering problem.
A question worth separating out:
Q: Who is accountable when sensitive data leaves through a vendor, API, or misconfigured system?
A: Accountability usually sits with the business owner of the data, the identity or platform team that granted access, and the vendor manager if external trust was involved. Frameworks such as Zero Trust and least privilege make that shared responsibility harder to ignore because they require continuous verification of access, not one-time approval.
👉 Read our full editorial: AI data readiness is becoming the missing control in breach prevention
