Topic starter
02/08/2026 11:29 am
TL;DR: 39.7% of data employees share with AI tools is sensitive, while endpoint-based AI agents grew 509% in 2025, according to Cyberhaven research, underscoring why legacy blocking and content-only DLP cannot govern machine-speed data flows effectively. The security issue is no longer whether employees will use AI, but whether organisations can apply policy without losing visibility or control.
Editorial analysis by NHI Mgmt Group, based on content published by Cyberhaven: “How Modern DLP Enables AI Adoption Without Slowing Down the Business”.
By the numbers:
- 39.7% of the data employees share with AI tools is sensitive, according to Cyberhaven research.
- Endpoint-based AI agents grew 509% in 2025, according to Cyberhaven research.
Key questions
Q: Where does traditional DLP fail in AI adoption programs?
A: Traditional DLP fails when it assumes data will only move through predictable network paths.
Q: How should organisations govern AI programs before scaling them enterprise-wide?
A: Organisations should define ownership, data quality checks, approval gates and retirement criteria before AI use cases proliferate.
Q: What are the signs that AI usage controls are not working as intended?
A: Common warning signs include sudden token spikes, repeated 429 responses, uneven consumption across users, and budget overruns that appear before the quarter ends.
Practitioner guidance
- Define AI data classes and release rules Map the data types employees commonly paste into AI tools, then assign explicit allow, prompt, or block decisions based on sensitivity and destination.
- Extend DLP to the endpoint Validate that DLP can observe AI activity on laptops and local workstations, not just network traffic or browser sessions.
- Track data lineage across AI workflows Preserve origin, classification, and destination context so transformed content can still be governed after summarisation or rephrasing.
Bottom line: Legacy DLP breaks down when employees and endpoint-based AI agents move sensitive data through channels that the control plane cannot reliably see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:44 pm
AI adoption governance is becoming a data-control problem before it becomes an AI-policy problem. Organisations are not failing because they lack a rule about AI use. They are failing because the control plane cannot see where sensitive data is going once employees move from sanctioned workflows into AI tools. For identity and access teams, that means the decisive question is no longer who may log in, but what data can leave a trusted context and under what policy. Practitioners should treat AI governance as an extension of data and identity control, not as a separate programme.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations balance AI enablement with security oversight?
A: They should permit experimentation, but only within a model that assigns ownership, sets data boundaries, and tracks usage cost and risk together. The key question is not whether AI is allowed. It is whether every AI-enabled workflow has a clear accountable owner and a documented control boundary.
👉 Read our full editorial: Modern DLP is becoming the control layer for AI adoption