Topic starter
14/08/2026 6:36 pm
TL;DR: Policy-based DLP struggles in AI-driven workflows because employees paste sensitive data into chatbots, copilots, and SaaS tools that traditional rule sets cannot inspect reliably, according to Orion. Static enforcement is no longer enough when context, intent, and retention sit outside enterprise control, making adaptive data protection the real requirement.
Editorial analysis by NHI Mgmt Group, based on content published by Orion: “Executive Summary: Policy-Reliant DLP Fails Against Shadow AI”.
Key questions
Q: What fails when policy-based DLP meets shadow AI?
A: Policy-based DLP fails when the organisation cannot see the tool or the workflow before data moves.
A: Shadow AI is riskier because data is often entered through a prompt and ingested instantly, which can create immediate and sometimes irreversible exposure.
Q: What are the signs that legacy DLP is failing against AI agent traffic?
A: Common signs include high alert volume with few prevented events, data moving through SaaS or browser paths that are not being blocked, and sensitive actions happening inside automated sessions that never reach human intervention.
Practitioner guidance
- Define approved AI data paths Map which AI tools, copilots, and SaaS platforms may receive sensitive data, then publish explicit handling rules for each approved path.
- Classify data before it reaches AI systems Apply sensitivity labels and content categories upstream so the organisation can decide whether code, customer data, or regulated information may be shared.
- Tie AI use to identity and session context Use user identity, device trust, and session risk to decide whether a prompt, upload, or share action should be allowed in real time.
Bottom line: Policy-based DLP was built for predictable data movement, while shadow AI and SaaS workflows now reshape information inside systems the enterprise does not fully control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:43 pm
Policy-based DLP is colliding with a control-plane problem, not just a detection problem. The article shows that static rules fail when data is transformed inside conversational systems rather than moved as a clean file or email. That means the governance model has to shift from post-event inspection to decisioning at the point of use. Practitioners should read this as a data-governance and identity boundary issue, not merely a DLP tuning issue.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Organisations with high levels of shadow AI faced an average of $670,000 in additional breach costs compared with those with little or none, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication. Classify sensitive data, define which datasets may enter AI workflows, and monitor outputs, logs, and downstream reuse. If governance stops at login, the organisation can approve access while still losing control of the data itself.
👉 Read our full editorial: Policy-based DLP is failing under Shadow AI and SaaS workflows