Topic starter
18/08/2026 2:49 pm
TL;DR: 2025 saw record-setting breaches, widespread AI-related leakage and repeated supply chain compromise, according to Ground Labs, while 155 countries now have enacted data protection and privacy laws, underscoring the gap between regulatory ambition and operational control. Data security is shifting from point-in-time compliance to continuous visibility, containment and governance across data, AI and third-party ecosystems.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Data security 2025: A retrospective perspective”.
Key questions
Q: What breaks when employees use unapproved AI tools with company data?
A: Governance breaks because the organisation loses visibility into where data and secrets are going, who can access them, and how they are being reused.
Q: Why do third-party services and packages increase data exposure risk so quickly?
A: They extend trust outside the organisation's own control plane, often using broad permissions, embedded secrets or unreviewed update paths.
Q: What are the signs that data security controls are failing across an organisation?
A: Common warning signs include unexplained data access spikes, sensitive files moving outside approved channels, poor audit trail coverage, repeated policy exceptions, and inconsistent access reviews.
Practitioner guidance
- Implement continuous sensitive-data discovery Map where regulated and business-critical data lives, how it moves and which services can access it.
- Lock down employee AI data pathways Create approved AI usage patterns for staff, define which data classes can never be pasted into external tools and log high-risk interactions.
- Treat third-party data paths as privileged Review supplier integrations, file-transfer services and package dependencies as trust channels rather than generic tooling.
Bottom line: 2025 showed that data breaches, AI leakage and supply chain compromise are converging faster than many organisations can update their controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:31 pm
Data security debt is now a governance problem, not just a tooling problem. The article shows that organisations are collecting legal obligations, AI usage risks and supplier exposure faster than they are closing the control gap. That creates a form of data security debt, where policy intent and operational reality diverge until the breach forces reconciliation. Practitioners should treat visibility and containment as standing governance requirements, not project outcomes.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Should organisations prioritise visibility or containment first for data security?
A: They need both, but containment should follow immediately when visibility reveals sensitive data in risky places. Visibility without containment only documents exposure, while containment without visibility misses the next source of leakage. The practical order is discover, classify, constrain and then verify that the same data cannot reappear in uncontrolled paths.
👉 Read our full editorial: Data security 2025 shows breach exposure outpacing control maturity