Topic starter
14/08/2026 6:35 pm
TL;DR: Legacy DLP built on regex policies is failing to keep pace with AI-driven data movement across endpoints, browsers, SaaS, and unauthorized apps, according to Orion’s event recap. The control gap is no longer classification first or more alerts, but context-aware detection that can see where data actually goes and why.
Editorial analysis by NHI Mgmt Group, based on content published by Orion: “AI is a Data Security Problem, CISOs Testify”.
Key questions
Q: What breaks when DLP relies only on regex and keyword scanning for AI use?
A: Regex and keyword scanning miss the decision point that matters most, which is the origin and sensitivity of the data before it is pasted.
Q: Why does AI-driven data movement increase exposure even when users have normal access?
A: Normal user access can still produce abnormal risk when AI tools and connected apps can copy, transform, and route data into places the security team does not monitor well.
Q: What are the signs that a DLP programme is not working as intended?
A: Common warning signs include high false-positive volume, noisy alerts that security teams ignore, weak coverage across SaaS and endpoints, and enforcement that blocks routine work more often than risky behaviour.
Practitioner guidance
- Map current data movement across AI and SaaS surfaces Instrument endpoint, browser, SaaS, and AI-connected workflows so you can see where sensitive data actually travels before it is classified or blocked.
- Shift from pattern-only rules to correlated detections Use behavioural and sequence-based signals to connect download, transform, rename, and upload events into one case instead of treating them as separate alerts.
- Deploy in-motion protection before full taxonomy completion Allow controls to act on observed data flows while labelling and policy work continues, rather than waiting for a perfect classification model.
Bottom line: Legacy DLP struggles because AI tools change both the path and the pace of sensitive data movement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
AI-driven data movement is now a governance problem, not just a tooling problem: once employees can route sensitive information through copilots, browsers, and shadow applications, the control question shifts from simple inspection to accountable visibility. The old DLP stack assumed data would pass through predictable channels and stable policies. That assumption is now broken, so programme owners need to treat data movement as a governed workflow, not a series of disconnected alerts.
A few things that frame the scale:
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: Should organisations prioritise data movement visibility before full data classification?
A: Yes, when AI adoption is moving faster than taxonomy work. Full classification is valuable, but it should not block immediate protection. If you can already see where data is going, you can reduce exposure now and feed those observations back into labelling, policy, and governance work later.
👉 Read our full editorial: AI-driven data loss prevention is replacing legacy DLP playbooks