Notifications
Clear all
Topic starter
02/08/2026 11:37 am
TL;DR: Visibility and control are different capabilities, and endpoint presence plus data lineage plus AI context are needed to act on data risk before it becomes liability, according to Cyberhaven. The architectural gap is now more consequential as agentic AI and endpoint workflows create risk that cloud-first monitoring and legacy DLP often miss.
NHIMG editorial — based on content published by Cyberhaven: Visibility Is Not Enough: The Case for Control at the Endpoint
Questions worth separating out
Q: How should security teams control sensitive data leaving endpoints?
A: Security teams should enforce data movement policy at the endpoint itself, not rely only on network controls or user training.
Q: Why do visibility tools fail to reduce cloud security risk on their own?
A: Visibility tools fail when they produce findings without telling teams which ones matter in production.
Q: How do organisations know if endpoint management is actually working?
A: They know endpoint management is working when inventory is accurate, patch backlogs are shrinking, remote actions succeed reliably, and access decisions reflect device trust state.
Practitioner guidance
- Enforce endpoint-level data control Place policy enforcement where data is copied, pasted, transformed, or shared on the device, because cloud logs alone will not catch the moment of action.
- Introduce lineage-aware triage rules Require lineage context before escalating alerts, so analysts can see origin, movement, and transformation instead of reacting to isolated file events.
- Separate human and AI agent activity Classify endpoint events by actor type, then apply different policy and review logic when an AI agent is manipulating data versus a user acting manually.
What's in the full article
Cyberhaven's full post covers the operational detail this post intentionally leaves for the source:
- How the endpoint agent is positioned to capture copy, paste, file movement, and application interaction events
- Why cloud-first telemetry and legacy DLP create timing gaps that make response harder
- How Data Lineage changes alert interpretation by linking origin, movement, and transformation
- What AI context adds when agents, not just users, are moving sensitive information
👉 Read Cyberhaven's analysis of endpoint visibility versus control for data security →
Endpoint visibility without control: are your data controls keeping up?
Explore further
02/08/2026 12:50 pm
Visibility without control is an accountability trap. Once a program can see a risk, it is on the hook for acting on it, and that changes the governance burden even if no enforcement capability exists. This is why dashboards full of findings can increase liability instead of reducing it. The practical conclusion is that security teams must treat observability as evidence, not as a control outcome.
A question worth separating out:
Q: How should teams manage insider risk when AI agents have legitimate access to sensitive data?
A: Treat AI agents as governed non-human identities, not as ordinary tools. Define what they can access, monitor the actions they can take, and revoke access when the workflow no longer needs it. Pair behavioural monitoring with IAM, PAM, and NHI controls so machine-scale access is visible, bounded, and auditable.
👉 Read our full editorial: Endpoint visibility without control leaves data risk unresolved
