Topic starter
18/08/2026 2:23 pm
TL;DR: Data security programmes stall when teams protect systems, not the sensitive data actually spread across cloud, SaaS, endpoints and legacy repositories, according to Ground Labs. The practical lesson is that discovery-led scoping, prioritisation and remediation are now the difference between controls that exist on paper and controls that reduce real exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Why most data security programs fail without discovery”.
By the numbers:
- A 2026 PwC Global Digital Trust Insights report cited by Ground Labs said firms lacked visibility into end points (53%) and legacy systems (55%), weakening their ability to withstand major cyber-attacks.
Key questions
Q: What breaks when data security controls stop at discovery and do not include remediation?
A: Discovery without remediation leaves teams with visibility but no risk reduction.
Q: Why do incomplete data inventories make data security riskier?
A: Incomplete inventories create false confidence.
Q: How do teams know if sensitive data discovery is actually working?
A: It is working when findings consistently lead to classification updates, access changes and remediation, not just dashboards.
Practitioner guidance
- Implement discovery-led scoping Map sensitive data across cloud, SaaS, endpoints, file shares, databases and legacy repositories before assigning control ownership or compliance scope.
- Tie remediation to data context Prioritise findings based on the sensitivity and exposure of the affected data, not on the platform where the alert originated.
- Create repeatable scans and monitoring Run continuous or scheduled discovery across newly created sources so migrations, AI projects and M&A activity do not create blind spots.
Bottom line: Data security programmes fail when teams cannot see the sensitive data they are supposed to protect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:14 pm
Data discovery is now a governance control, not a reporting convenience. When inventories are fragmented, every downstream security decision inherits uncertainty. That uncertainty affects scoping, ownership, prioritisation and auditability, which means discovery must be treated as a first-class control surface in data security programmes. The practitioner conclusion is straightforward: if the inventory is incomplete, the programme is operating on partial evidence.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Business leaders plan to spend $124 million on average on AI in 2026, and 91% say data security and risk will shape their AI strategy.
A question worth separating out:
Q: When should organisations prioritise discovery over access reviews?
A: Discovery should come first whenever the team cannot confidently map all applications, identities, and entitlements in scope. If the review population is incomplete, certification becomes a documentation exercise instead of a control. Prioritise discovery before the next major audit, offboarding cleanup, or recertification cycle.
👉 Read our full editorial: Data security programs fail when discovery cannot find sensitive data