Notifications
Clear all
Topic starter
14/08/2026 6:36 pm
TL;DR: Generative AI has broken the old DLP model because data now moves through chats, agents, browsers, plugins, and embedded features, creating AI-specific leak paths that traditional file and endpoint controls do not fully see, according to Orion. The practical shift is from generic DLP coverage to scenario-based control over prompts, responses, agent behaviour, and API access.
NHIMG editorial — based on content published by Orion: Receive Updates and the AI data loss threat modeling framework
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI assistants create new data loss risks beyond traditional DLP?
A: Because they move data through prompts, responses, plugins, and agent actions rather than only through files or emails.
Q: What do organisations get wrong about AI safety and access control?
A: Organisations often focus on model outputs while ignoring the privileges behind the model.
Practitioner guidance
- Build an AI data-flow inventory List every AI tool, browser extension, embedded assistant, and agent that can reach enterprise data stores or endpoints.
- Assign control ownership by layer Decide which team owns SaaS DLP, Endpoint DLP, and prompt or API inspection inside the AI layer.
- Treat AI agents as governed identities Require explicit authentication, scoped authorisation, and session logging for agents that call internal systems or external APIs.
What's in the full article
Orion's full analysis covers the operational detail this post intentionally leaves for the source:
- The framework’s full risk taxonomy for AI-specific data loss, including the scenario structure behind prompt leakage and context leakage.
- Examples of how the model maps risks to SaaS, endpoints, enterprise cloud, AI agents, apps, and browsers.
- The practical walkthrough for using the framework to prioritise controls and evaluate unmanaged AI tools.
- The validation layer that shows how teams can test scenarios rather than only discussing them in policy terms.
👉 Read Orion's full analysis of AI-driven data loss and modern DLP modeling →
AI-driven data loss: what controls are teams missing now?
Explore further
14/08/2026 6:43 pm
AI-driven data loss is now a governance problem, not just a content filtering problem. The article shows that sensitive information can leave the organisation through chats, agent actions, browser plugins, and embedded assistants without a traditional file transfer event. That means the old DLP model, which focuses on documents and endpoints, no longer matches the operational reality. For practitioners, the control question shifts from blocking exfiltration to defining which AI interactions are allowed to exist at all.
A question worth separating out:
Q: How can teams tell whether AI oversharing controls are actually working?
A: They should measure whether realistic prompts produce restricted answers, redactions, or blocks when policy should apply. If the assistant still returns sensitive context under common follow-up questions, the control is not effective. Effective governance changes the response the user sees, not just the log entries security teams review.
👉 Read our full editorial: AI-driven data loss breaks traditional DLP assumptions
