Notifications
Clear all
Topic starter
02/08/2026 11:40 am
TL;DR: Data security programs break when they rely on shallow telemetry and brittle rules instead of endpoint presence, data lineage, and contextual AI, according to Cyberhaven’s analysis. In the agentic AI era, that gap widens because AI agents and users move data across endpoints and applications faster than cloud-only controls can see.
NHIMG editorial — based on content published by Cyberhaven: The Three Pillars of Durable Data Security: Presence, Lineage, and AI
By the numbers:
- 49.5% of developers were using desktop-based AI coding assistants by December 2025, up from roughly 20% at the start of that year.
Questions worth separating out
Q: How should security teams govern AI-assisted data movement across endpoints?
A: Security teams should govern AI-assisted data movement by starting at the endpoint, where content is opened, copied, transformed, and redistributed.
Q: Why do cloud-only data controls miss so much risk?
A: Cloud-only controls miss risk because the most important handling often happens before data reaches a managed service.
Q: What do security teams get wrong about AI access risk?
A: Many teams focus on the model while ignoring the identity path that reaches it.
Practitioner guidance
- Expand telemetry to endpoint handling points Instrument the devices where files are opened, copied, pasted, and handed to AI tools so you can see the action at the point of use.
- Build lineage for high-risk data paths Trace sensitive content from creation through transformation, transfer, and egress so you can distinguish normal business movement from risky propagation across apps and endpoints.
- Tune policy using observed behaviour Replace static rule assumptions with policies derived from real movement patterns, then review exceptions that generate repeated false positives.
What's in the full article
Cyberhaven's full post covers the operational detail this post intentionally leaves for the source:
- Endpoint telemetry design choices for desktop AI assistants and local workflows
- Operational examples of lineage tracking across file creation, transformation, and egress
- How behavioural models reduce false positives when security teams tune policy
- The article's implementation framing for AI-native endpoint data protection
👉 Read Cyberhaven's analysis of presence, lineage, and AI for data security →
Endpoint presence and data lineage: are data security controls keeping up?
Explore further
02/08/2026 12:52 pm
Presence, lineage, and AI form a control system, not a feature list. Security programmes fail when these layers are treated as separate capabilities instead of one operating model. Endpoint presence supplies the evidence, lineage supplies the context, and AI supplies the decisioning layer that can scale across event volume. The field is moving toward evidence-driven control design, not rule maintenance. Practitioners should evaluate whether their architecture can actually preserve that dependency chain.
A question worth separating out:
Q: How can organisations tell whether their data security programme is actually improving?
A: Look for fewer unknown data stores, clearer ownership of sensitive datasets, faster access review completion, and measurable reductions in overexposed information. If the same high-risk data keeps appearing in audits or incidents, the programme is producing activity without control.
👉 Read our full editorial: Data security hardens only when presence, lineage, and AI align
