Topic starter
01/08/2026 8:56 pm
TL;DR: The old split between data in motion and data at rest breaks down when files move from storage into GenAI tools without a traditional network event, leaving legacy DLP and posture tools blind to the full path, according to Cyberhaven. Data lineage, not state, becomes the more durable security model for AI-era data governance.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Data in Motion vs. Data at Rest: Why the Model Breaks”.
By the numbers:
- Cyberhaven Labs reports an 80% year-over-year increase in data movement events into and out of GenAI SaaS from June 2025 to June 2026.
Key questions
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: Why do legacy data state controls miss AI data risk?
A: Because they assume data crosses a visible boundary such as email, network egress, or storage access.
Q: What are the signs that data posture controls are failing in AI workflows?
A: Common signs include unexplained prompt usage, sensitive files appearing in AI tools without matching transfer logs, and investigations that can identify the file’s destination but not its intermediate hops.
Practitioner guidance
- Inventory AI data movement paths Map where sensitive files enter GenAI tools, copilots, and connected assistants, including browser paste, upload, sync, and connector-based flows.
- Shift from state checks to lineage monitoring Prioritise controls that record origin, hops, and handlers across endpoints and cloud apps so investigations can reconstruct the full path of a file.
- Review delegated access into AI tools Audit the human, service, and connector identities that can move data into AI systems, then remove unnecessary permissions that expand data exposure paths.
Bottom line: The two-state data model no longer explains how sensitive information moves through GenAI tools and copilot workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:04 pm
Data lineage is becoming the organising principle for AI-era data governance. The old state-based model was built for storage and transmission boundaries that no longer hold in browser-mediated AI workflows. When a file can move from a repository into a prompt without a network event, visibility has to shift from location to path. Practitioners should treat lineage as the durable control plane, not an optional telemetry layer.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should IAM teams do when AI workflows touch sensitive data?
A: Treat AI usage as part of the identity and access review process. IAM teams should validate who can access the data, where that data can be used, and whether the AI workflow has guardrails that match the data classification. That creates a control view that is actionable during recertification and audit.
👉 Read our full editorial: Data in motion and data at rest no longer explain AI data risk