Topic starter
25/08/2026 9:13 am
TL;DR: Data growth is accelerating toward 395ZB by 2028, while AI, SaaS sprawl and hybrid cloud expansion are multiplying the places sensitive information can reside, according to Ground Labs' analysis of IDC, Okta and Flexera data. The governance challenge is no longer just storage volume, but continuous discovery, classification and access control across fragmented estates.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Data-centric governance in the age of AI”.
By the numbers:
- By 2028, the amount of data created, captured, replicated and consumed worldwide will reach almost 395ZB.
- Companies with 2,000 or more employees deploy an average of 247 apps.
- 70% of organisations are operating hybrid cloud environments.
Key questions
A: Security teams should start by discovering where sensitive data lives, who can reach it, and which identities or services are overexposed.
A: Perimeter controls assume data stays inside a defined boundary, but modern estates replicate it across cloud, SaaS and AI services.
Q: What are the signs that data governance is failing in a mixed cloud and legacy environment?
A: Common warning signs include unknown data locations, inconsistent classification, unclear access ownership, and ad hoc retention decisions.
Practitioner guidance
- Implement continuous data discovery Inventory structured, unstructured and semi-structured data across cloud, SaaS and on-premises locations, then refresh the inventory as new tools and workloads appear.
- Extend access reviews to data-processing services Review not only user permissions but also application integrations, AI tools and third-party services that can ingest, copy or expose sensitive datasets.
- Classify data by sensitivity and business context Tag information by type, sensitivity, owner, purpose, master location and retention period so policy decisions can follow the data lifecycle.
Bottom line: AI-driven data sprawl makes the location, sensitivity and reachability of information a governance issue, not just a storage issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 9:14 am
Data-centric governance is now an identity problem as much as a data problem. Once data moves through SaaS platforms, AI tools and third-party services, the effective control point shifts from the perimeter to the access path. That means human identity, application identity and non-human identity governance all become part of the same exposure problem. Practitioners should treat DSPM as the layer that reveals where identity governance is failing at the data boundary.
A question worth separating out:
Q: Should organisations prioritise DSPM before tightening AI usage policies?
A: Yes, if they lack clear visibility into where sensitive data sits and how it moves. AI usage policies matter, but they are weak if teams cannot find the data being consumed or copied by tools and users. Discovery and classification should come first because policy enforcement depends on knowing the asset and its exposure.
👉 Read our full editorial: Data-centric governance is becoming essential as AI expands data sprawl