Topic starter
02/08/2026 11:27 am
TL;DR: Financial services firms are adopting AI faster than they can govern it, creating measurable gaps in data handling, visibility, and disclosure obligations under GLBA and SEC rules, according to Cyberhaven’s 2026 AI Adoption & Risk Report: Financial Services. The control problem is not AI itself, but whether firms can prove where regulated data went, who touched it, and what controls were active.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “Financial Services AI Security: Meeting GLBA and SEC Rules”.
By the numbers:
- Cyberhaven says there is a 17x difference in AI adoption between the most aggressive financial services firms and the most cautious ones.
Key questions
Q: How should organisations govern shadow AI without blocking legitimate use?
A: Start with approved-use policy, tool inventory, and data classification.
Q: Why do endpoint AI agents create regulatory risk for financial firms?
A: Because they inherit a user's access and can move or transform data locally without the same visibility as a standard application session.
Q: What are the signs that AI use is outside a firm's control boundary?
A: Common signals include personal-account usage, AI features hidden inside approved software, data submissions that never appear in central logs, and agent activity that cannot be traced back to a governed workflow.
Practitioner guidance
- Inventory all AI entry points Catalog standalone GenAI tools, embedded AI features, personal-account usage, and endpoint agents so regulated data paths are visible before you set policy.
- Enforce data controls at the point of submission Block or alert when nonpublic personal information, account data, or sensitive internal content is entered into AI tools, rather than relying on network-only inspection.
- Separate approved software from approved AI processing Treat AI functions inside sanctioned applications as distinct data paths with their own logging, retention, and approval requirements.
Bottom line: Financial services AI risk is no longer limited to model safety or productivity governance, because regulated data now moves through tools that may sit outside approved control paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:43 pm
AI security in financial services is now a disclosure problem as much as a data control problem. The article shows that AI use can trigger GLBA monitoring expectations and SEC materiality assessment at the same time. That means firms are no longer just governing model use or employee productivity tools. They are governing evidence, because if they cannot reconstruct the data path, they cannot reliably defend compliance.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When do AI data exposure events become a GLBA or SEC accountability issue?
A: When the firm cannot show what customer data was processed, whether monitoring and logging were active, and whether the exposure reached the threshold for breach notification or material disclosure. At that point the issue is not only technical loss, but reporting and board accountability.
👉 Read our full editorial: Financial services AI security is now a GLBA and SEC issue