Topic starter
19/08/2026 4:03 pm
TL;DR: Data loss prevention now has to follow sensitive information across SaaS, cloud, browsers, GenAI, endpoints, APIs, and MCP-connected workflows, because detection-only controls no longer stop data from moving into the wrong place, according to Strac. The shift matters for IAM and NHI teams because AI tools and agents increasingly create new data egress paths that must be governed, not just observed.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Top Components of Data Loss Prevention”.
Key questions
Q: What breaks when DLP only detects data after it has already moved?
A: When DLP is detection only, the security team learns about exposure after the data has already been copied, shared, or transformed in another system.
Q: Why do AI agents and MCP-connected workflows create new data exposure risks?
A: AI agents and MCP-connected workflows expand access beyond human users into systems that can retrieve, transform, and move sensitive data automatically.
Q: What are the signs that DLP is too narrow for modern SaaS and AI use?
A: A DLP programme is too narrow when it only covers email or endpoints, cannot inspect browser activity, and has no policy coverage for SaaS, GenAI or MCP-connected tools.
Practitioner guidance
- Instrument SaaS and browser data paths Inspect messages, uploads, downloads and copy-paste actions in the SaaS and browser workflows where sensitive information actually moves, not just where it is stored.
- Apply inline remediation instead of alert-only controls Use redaction, masking, blocking, quarantine or deletion when policy is violated so exposure is interrupted at the point of movement.
- Classify and govern MCP-connected workflows Map which MCP servers, tools and connected apps can retrieve or forward sensitive records, then treat those paths as controlled egress channels.
Bottom line: Modern DLP has to govern where sensitive data moves, not just identify where it exists.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:38 pm
Data movement is now the control surface: The old assumption that protecting the perimeter or the mailbox is enough no longer holds. Sensitive data now travels through SaaS, AI prompts, browser sessions and connected tools, so governance has to follow the data itself. Practitioners should treat data movement as a first-class security domain, not a downstream logging problem.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: How should teams connect data discovery with data movement controls?
A: Teams should link discovery and enforcement so classification immediately informs blocking, masking or encryption rules. The practical test is whether a newly found sensitive record can trigger a policy response in the same control layer that sees it move. If not, the organisation has visibility but not governance.
👉 Read our full editorial: Modern DLP must govern data movement across SaaS, AI, and MCP