Topic starter
18/08/2026 2:49 pm
TL;DR: Fragmented visibility, shadow AI and manual compliance are still blocking safe AI scale in financial services, according to Securiti. Sensitive data access, evidence generation and AI behaviour need to be governed together if pilot gains are to survive production.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “DataAI Security for Financial Services: Turn Risk Into competitive Advantage”.
By the numbers:
- Institutions using AI for underwriting report a 25% increase in loan throughput.
Key questions
Q: Why do shadow AI and fragmented data visibility create such high risk in financial services?
A: Because the organisation loses the ability to answer three questions at once: what data exists, who can reach it, and whether access is still justified.
Q: What are the biggest signs that AI governance is failing in BFSI?
A: The clearest signs are duplicate data stores, inconsistent entitlements, manual evidence gathering and AI pilots that expand without a defined control owner.
Q: How should security teams govern AI access to sensitive financial data?
A: They should combine identity governance with data classification so access decisions reflect both who is acting and what data is involved.
Practitioner guidance
- Implement sensitive data discovery across AI estates Inventory structured and unstructured data sources feeding AI use cases, including SaaS, cloud and hybrid repositories, then map where regulated fields can reach prompts or outputs.
- Right-size entitlements for AI workflows Review which users, service accounts and automation paths can access cardholder data, account data and other regulated fields, then remove unnecessary access and apply masking where appropriate.
- Automate continuous compliance evidence Capture access changes, exposure findings and remediation actions as part of normal operations so PCI, DORA and GDPR evidence is generated continuously rather than assembled after the fact.
Bottom line: Financial services AI programmes fail fastest when sensitive data visibility, access governance and evidence generation are handled as separate workstreams.
Glossary terms: Shadow AI, Data Access Governance, Continuous Compliance, Policy-Based Access Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:31 pm
DataAI governance is now an entitlement problem, not just a model-risk problem. BFSI teams are discovering that the practical constraint on AI is often who can see which data, under what conditions, and with what evidence trail. If that question is unanswered, model risk controls sit too late in the workflow to matter. The practitioner conclusion is to treat data access governance as the front line of AI control.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Should financial institutions prioritise compliance automation or access governance first?
A: Access governance comes first, because automation cannot prove control over access that was never properly scoped. Once entitlements are right-sized and sensitive fields are masked where needed, compliance automation can generate trustworthy evidence from the resulting control state. Without that sequence, you only automate the reporting of a weak governance model.
👉 Read our full editorial: DataAI security in financial services needs tighter governance