Topic starter
02/08/2026 11:37 am
TL;DR: Visibility and control are different capabilities, and endpoint presence plus data lineage plus AI context are needed to act on data risk before it becomes liability, according to Cyberhaven. The architectural gap is now more consequential as agentic AI and endpoint workflows create risk that cloud-first monitoring and legacy DLP often miss.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Visibility Is Not Enough: The Case for Control at the Endpoint”.
By the numbers:
- 49.5% of developers were using desktop-based AI coding assistants by December 2025, up from roughly 20% at the start of the year.
- The article says nearly half of all developers, 49.5%, were using desktop-based AI coding assistants by December 2025.
Key questions
Q: What breaks when endpoint visibility is not paired with real control?
A: Visibility without control turns security into documentation.
Q: Why do AI workflows require more than endpoint-based data controls?
A: AI workflows can move sensitive information through prompts, retrieved context, and generated output without creating a visible file-transfer event on the device.
Q: What are the signs that data security controls are failing across an organisation?
A: Common warning signs include unexplained data access spikes, sensitive files moving outside approved channels, poor audit trail coverage, repeated policy exceptions, and inconsistent access reviews.
Practitioner guidance
- Build controls at the point of data action Place enforcement where copy, paste, transform, and share events occur so the program can intervene before data leaves an approved boundary.
- Correlate endpoint events with data lineage Tie device activity back to source, modification history, and downstream movement so alerts reflect what the data means, not just that it moved.
- Treat AI agents as governed runtime actors Define which agent behaviours are allowed to access, summarise, or redistribute sensitive data and require monitoring for those actions at execution time.
Bottom line: The core problem is architectural: visibility can describe data movement, but only endpoint control can stop risky movement in time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:50 pm
Visibility without control is a governance trap, not a tooling gap. Once a security team can see a risk, the organisation inherits accountability for it even if it cannot stop the action in time. That is a material shift in legal and operational exposure, because awareness without enforcement turns security findings into unresolved liability. Practitioners should treat endpoint control as the governance threshold, not the dashboard.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: How should teams govern agent activity when it can move data autonomously?
A: Teams should treat agent activity as a governed operating behaviour with explicit permissions, observed actions, and bounded destinations. If the agent can read, summarise, or redistribute sensitive information, those actions need runtime control and auditability, not just policy language.
👉 Read our full editorial: Endpoint visibility without control leaves data risk unresolved