Notifications
Clear all
Topic starter
18/08/2026 2:22 pm
TL;DR: The decisive data security choice is architectural: scan data in place or move content to the vendor cloud, because that decision affects cost, accuracy, auditability, and the speed at which AI-era data risk can be governed, according to Sentra. The compliance question is now inseparable from the control question, especially when RAG and continuous agents outpace periodic review cycles.
NHIMG editorial — based on content published by Sentra: in-environment data scanning versus data egress for sensitive data classification
By the numbers:
- At petabyte scale, in-environment scanning has processed 9 petabytes in under 72 hours at roughly $40,000 a year.
- In-environment classification is reported at better than 98% accuracy at scale.
Questions worth separating out
Q: What breaks when data classification moves sensitive content into a vendor cloud first?
A: The main failure is trust expansion.
Q: Why do RAG systems complicate data access control?
A: RAG can retrieve authorised fragments from multiple sources and recombine them into outputs that were never reviewed as a whole.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Classify processing location as a control requirement Require vendors to state exactly where raw content is processed during discovery and classification, and reject proposals that only describe where results are stored.
- Test AI output paths against source permissions Review RAG and embedding workflows to confirm that output generation cannot recombine fragments into disclosures outside intended access scope.
- Replace batch review with continuous monitoring for agent activity Set alerting and investigation thresholds for continuous AI-driven data access, especially where agents can make retrieval decisions without human approval.
What's in the full article
Sentra's full article covers the operational detail this post intentionally leaves for the source:
- Side-by-side architecture comparison of in-environment and data-egress scanning models
- Petabyte-scale performance and cost observations from real deployments
- Why compliance, retention, and audit handling differ when data leaves the customer cloud account
- How AI readiness changes the governance case for continuous, in-place analysis
👉 Read Sentra's analysis of in-environment scanning versus data egress →
In-environment vs egress scanning: what should data teams do now?
Explore further
18/08/2026 3:13 pm
Architecture is now a governance decision, not a deployment preference. In sensitive data programmes, the location of analysis determines the control boundary. If content leaves the customer environment, the organisation inherits a second trust domain, a second retention problem, and a second audit story. That complicates both IAM oversight and data governance because the analysis path becomes part of the risk surface, not just the tool stack. Practitioners should treat processing location as a control requirement.
A question worth separating out:
Q: Who is accountable when AI tools expose sensitive information or weaken audit evidence?
A: Accountability should sit with the control owner for the workflow, not with the tool itself. Security, IAM, and GRC leaders should define ownership for data-handling rules, approval paths, evidence capture, and exception handling before AI use expands, so responsibility is clear when something goes wrong.
👉 Read our full editorial: In-environment data scanning is becoming the default control question
