Topic starter
18/08/2026 2:32 pm
TL;DR: AI assistants, agentic browsers, and automation platforms are creating new data loss paths because employees can paste sensitive information directly into browser-based workflows, according to Seraphic. The control problem is no longer file movement alone, but real-time governance of prompts, responses, and third-party AI interactions.
Editorial analysis by NHI Mgmt Group, based on content published by Seraphic: “Data Loss Protection: How to Stop AI-Driven Data Loss”.
Key questions
Q: Where does endpoint DLP fail in practice for browser and AI workflows?
A: It fails when sensitive data moves through a browser session, SaaS upload, or GenAI prompt that is outside the control boundary the endpoint can reliably observe.
Q: Why do browser-based AI tools create more data loss risk than traditional apps?
A: Browser-based AI tools create more risk because they combine user identity, live prompts and third-party processing in a single session.
Q: What are the signs that AI data leakage controls are not working?
A: Warning signs include employees using public GenAI tools without oversight, security teams unable to identify which tool was used, and no audit trail showing what data was shared.
Practitioner guidance
- Implement browser-level DLP for AI workflows Move enforcement into the browser so prompts, pasted content and AI responses can be assessed before data leaves the session.
- Classify sensitive data by AI-sharing risk Define which categories of financial, proprietary or regulated data must be blocked, redacted or approved before use in AI tools.
- Add prompt-injection checks to AI governance Treat suspicious instructions, hidden prompts and unexpected model behaviour as policy events that require blocking or escalation.
Bottom line: AI-enabled workflows are exposing sensitive data through browser interactions that endpoint DLP often cannot observe in time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:19 pm
Browser-based AI is now part of the data plane, not just the productivity layer. Once employees paste sensitive material into AI chats, copilots or automation workflows, the control problem changes from file movement to interaction governance. Endpoint DLP can still matter, but it no longer defines the decisive boundary. Practitioners should treat browser sessions as a governed data path, not an unregulated convenience layer.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Who should own AI identity governance in the enterprise?
A: AI identity governance should be owned jointly by identity, security, and platform teams, with clear accountability for provisioning, monitoring, and revocation. If ownership sits only with one group, the organisation usually misses either the technical controls or the operational lifecycle. Shared governance is essential because the risk crosses IAM, NHI, and data access domains.
👉 Read our full editorial: AI use is exposing data loss gaps that endpoint DLP misses