Topic starter
18/08/2026 2:28 pm
TL;DR: Email has become a high-volume data transport layer for credentials, PHI, PII, screenshots, and shared links, and legacy DLP still misses much of that context, according to Polymer. The control gap is no longer attachment scanning but runtime visibility into who is sending what to which human or LLM and why.
Editorial analysis by NHI Mgmt Group, based on content published by Polymer: “How email became the weakest link in enterprise security”.
Key questions
Q: What breaks when email security only scans attachments?
A: Attachment-only DLP misses the most common modern leak paths: data pasted into message bodies, screenshots, and text copied into AI tools.
Q: Why does email exposure become riskier when LLMs are in the workflow?
A: LLMs can ingest, summarise, and reuse inbox content, which turns a one-time disclosure into durable model exposure.
Q: What are the signs that email trust controls are failing?
A: Repeated replies to suspicious requests, high forward rates, weak reporting discipline, and inconsistent escalation around vendor changes are all warning signs.
Practitioner guidance
- Implement runtime email controls Move beyond attachment rules and inspect body text, embedded screenshots, and shared links at send time so sensitive material is governed before it leaves the mailbox.
- Correlate data lineage across channels Connect downloads, uploads, edits, and outbound messages across SaaS apps and endpoints so one exfiltration chain does not appear as separate benign events.
- Classify AI destinations as policy targets Treat ChatGPT, Claude, and similar tools as distinct recipients in policy logic so email controls can block or redact content before model ingestion.
Bottom line: Email has become a data transport layer for sensitive information, which makes attachment-centric DLP too narrow for current collaboration and AI workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:16 pm
Email has become a governance problem, not just a messaging problem. The article shows that the control failure is not limited to content matching, because sensitive data now moves through bodies, screenshots, links, and AI workflows. That means data loss prevention has to be treated as runtime governance over information flow, not retrospective scanning after disclosure. Practitioners should reframe email as a controlled data channel with policy boundaries.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat AI email recipients differently from human recipients?
A: Yes. Human recipients and AI systems create different governance risks because one reads the message and the other may store, summarise, or learn from it. Policy should reflect that difference by applying stricter handling to sensitive data destined for LLM interfaces, especially when the content includes credentials, PHI, or financial information.
👉 Read our full editorial: Email data exposure is outpacing legacy DLP controls