Topic starter
02/08/2026 11:54 am
TL;DR: At Axos Bank, the security team frames risk management around full visibility into where data sits, how it moves, and which protections are actually applied, according to Cyberhaven's Q&A with CISO Raghu Valipireddy. The implication is that broad controls without data context create false confidence, and DSPM becomes most useful when it ties policy to real usage rather than assumption.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Q&A: Managing Risk Through Data Visibility at Axos Bank”.
Key questions
Q: How should security teams use DSPM to reduce data risk in banking?
A: Security teams should use DSPM to discover where sensitive data lives, which accounts and systems touch it, and whether protections match actual movement patterns.
Q: Why do broad controls create false confidence when data visibility is weak?
A: Broad controls can look complete while still missing the real exposure pattern if teams cannot see where data resides or how it moves.
Q: What are the signs that data controls are not aligned to real usage?
A: Common signs include universal policies applied across too many systems, unclear ownership of sensitive datasets, and access reviews that cannot explain why a control applies to a specific data flow.
Practitioner guidance
- Map sensitive data to actual access paths Identify where regulated and customer data resides, then trace the users, applications, and service accounts that can reach it so access reviews are based on reality rather than system names.
- Validate protection scope against real data movement Check whether the controls you report on actually follow the data as it moves between repositories, collaboration tools, and operational systems, not just where the policy was first applied.
- Include non-human identities in data-risk reviews Treat service accounts, automation, and application credentials as part of the data governance model whenever they can read, copy, or move sensitive records.
Bottom line: The core risk is not the absence of security controls, but the inability to prove that those controls apply to the right data at the right time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:03 pm
Data visibility is now a governance control, not just a monitoring feature. When teams cannot see where sensitive data lives or how it moves, they are forced into broad protections that trade precision for comfort. That creates a false sense of control, especially in regulated environments where evidence of effective protection matters as much as policy intent. Practitioners should treat visibility as part of the control plane, not as an after-the-fact reporting layer.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do data visibility and identity governance work together?
A: Data visibility tells you what needs protection, while identity governance tells you who or what can reach it. When the two are connected, access decisions can account for service accounts, applications, and human users as part of the same risk picture, instead of treating identity controls and data controls as separate problems.
👉 Read our full editorial: Data visibility is the control plane for risk management at Axos Bank