Topic starter
20/08/2026 5:57 pm
TL;DR: AI can scan for issues but cannot secure an organisation on its own, because effective DLP and data protection depend on cross-environment context, real-time enforcement, and business-aware signal correlation, according to Nightfall. That distinction matters for identity and access teams because sensitive data exposure often follows overbroad access, unmanaged AI app use, and weak governance across channels.
Editorial analysis by NHI Mgmt Group, based on content published by Nightfall: “AI Can Scan Your Code. It Can't Secure Your Organization.”.
Key questions
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: Why does overbroad access make AI-driven data exfiltration harder to stop?
A: Because the data is often sensitive for business reasons, not because of its format.
Q: How do you know if context-aware DLP is working?
A: It should reduce time to enforcement, distinguish legitimate business transfers from risky ones, and produce fewer false positives on routine collaboration.
Practitioner guidance
- Map data context across channels Identify where sensitive business data originates, how it moves through SaaS, endpoints, and AI apps, and which signals establish its sensitivity in each environment.
- Correlate access with movement Tie file access, repeated downloads, outbound sharing, and prompt activity into one detection path so that isolated events can be evaluated together.
- Tighten access where context is missing Review entitlements that let users reach high-value data without a current business reason, especially in shared drives, collaboration tools, and AI-enabled workflows.
Bottom line: AI code scanning can help find issues, but it does not by itself create a data security programme that understands business context or can enforce policy across channels.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:37 pm
Context-aware DLP is now the governing concept, not pattern-based inspection. The article shows that corporate IP is defined by meaning, location, and business relevance, which cannot be captured by a single regex or code scan. That makes the security problem fundamentally one of environment correlation, not signature coverage. Practitioners should treat context as the control plane for sensitive data governance.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should teams do when sensitive data reaches consumer AI apps or personal cloud accounts?
A: Treat that as an enforcement problem, not just an awareness problem. Block or redirect the transfer when policy and context show the data is restricted, then review which identities, channels, or entitlements made the movement possible. The goal is to stop release before the data leaves governed control.
👉 Read our full editorial: AI data security needs context, not just code scanning