Notifications
Clear all
Topic starter
20/08/2026 5:56 pm
TL;DR: Infrastructure security can detect events but often cannot prove which sensitive data was accessed, copied, or exfiltrated, leaving teams unable to scope breach impact or support compliance under GDPR and CCPA/CPRA, according to Sentra. The real control gap is data-level visibility across cloud, SaaS, AI, and migration states, where identity paths and exposure drift outpace point-in-time audits.
NHIMG editorial — based on content published by Sentra: Data-centric security is required for today's compliance and breach response
Questions worth separating out
Q: How should security teams prove whether sensitive data was actually accessed during a breach?
A: They need data-level evidence, not just infrastructure alerts.
Q: Why do infrastructure controls fail to answer breach impact questions?
A: Infrastructure controls observe systems, not the data inside them.
Q: How do organisations know whether their security data foundation is working?
A: Look for fewer manual fixes, faster migrations, cleaner routing decisions, and less analyst time spent correcting schemas or chasing missing context.
Practitioner guidance
- Bind identities to datasets in access reviews Extend entitlement review to include the specific sensitive datasets reachable by each human, service, and workload identity.
- Track sensitive data through migrations and AI workflows Require lineage and classification to persist through cloud migration, SaaS synchronisation, ETL, and AI pipeline stages.
- Tie incident response to data-level evidence When an incident occurs, preserve evidence about which records, objects, or datasets were actually accessed before rebuilding systems or closing tickets.
What's in the full article
Sentra's full blog post covers the operational detail this post intentionally leaves for the source:
- How Sentra frames continuous discovery and classification for sensitive data across cloud, SaaS, and on-prem environments
- The data-level visibility model used to connect identity access paths with breach impact and compliance evidence
- Operational examples of how data detection and response supports incident scoping during ransomware and extortion events
- The distinction between infrastructure alerts and proof of actual data exposure in regulated environments
👉 Read Sentra's analysis of why data-centric security is required for breach response →
Data visibility gaps: what IAM and security teams must prove now?
Explore further
20/08/2026 6:36 pm
Infrastructure-only security has become a visibility debt problem. Tools that observe alerts but not data context force incident teams to infer exposure after the fact. That is not just a tooling limitation, it is a governance gap because regulators now expect proof about access, lineage, and current residency. For IAM teams, the practical conclusion is that identity control and data control must be joined in the same operating model.
A question worth separating out:
Q: Who is accountable when sensitive forensic records are exposed in a breach?
A: Accountability usually sits with both the data owner and the security governance function. The data owner must define sensitivity and access rules, while security must enforce segmentation, privilege limits, and recovery isolation. In regulated or public-sector environments, that accountability also extends to how evidence integrity and access review are documented.
👉 Read our full editorial: Data-centric security is overtaking infrastructure-only breach response
