Notifications
Clear all
Topic starter
14/08/2026 6:36 pm
TL;DR: Policy-based DLP struggles in AI-driven workflows because employees paste sensitive data into chatbots, copilots, and SaaS tools that traditional rule sets cannot inspect reliably, according to Orion. Static enforcement is no longer enough when context, intent, and retention sit outside enterprise control, making adaptive data protection the real requirement.
NHIMG editorial — based on content published by Orion: policy-based DLP in the age of Shadow AI
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: How should security teams govern shadow AI without blocking productivity?
A: Use visibility-based controls instead of blanket bans.
Q: Why do policy-based DLP controls fail in AI-enabled workflows?
A: They fail because they assume data moves through predictable channels and can be matched against fixed patterns.
Q: What do organisations get wrong about shadow AI governance?
A: They often try to block unsanctioned tools at the network layer without changing employee behaviour or providing an approved alternative.
Practitioner guidance
- Map sanctioned AI use paths Inventory which AI tools, copilots, and embedded SaaS features employees are already using, then classify each one by approved, restricted, or unsanctioned status.
- Bind sensitive data controls to identity context Require higher-friction controls when regulated or proprietary data is being sent through external AI systems, especially where the organisation cannot attest to retention or reuse conditions.
- Replace rule-only inspection with behaviour-aware controls Use tools that can assess whether a transfer matches normal business behaviour, not just whether it contains a sensitive token or pattern.
What's in the full article
Orion's full article covers the operational detail this post intentionally leaves for the source:
- The full DLP evolution narrative from keyword filtering to proxy inspection and CASB enforcement.
- The specific examples of AI-driven data movement through Copilot, ChatGPT, Claude, and Gemini workflows.
- The white paper context behind the shortened article and the vendor's proposed context-aware protection model.
👉 Read Orion's analysis of why policy-based DLP is failing in the Shadow AI era →
Shadow AI and DLP: what security teams are missing now?
Explore further
14/08/2026 6:43 pm
Static DLP is a control model, not a security outcome. The article shows that rule-based inspection can detect known patterns, but it cannot keep pace with prompt-based data movement, embedded copilots, or AI systems that interpret and recombine information. That means the failure is architectural: organisations are still trying to govern dynamic data behaviour with static enforcement logic. Practitioners should treat DLP as one signal in a broader governance stack, not as the boundary itself.
A question worth separating out:
Q: Which frameworks matter most for AI-era data protection decisions?
A: NIST CSF is useful for structuring governance, protection, detection, and response, while NIST AI 600-1 helps teams address generative AI risk more directly. If identity context is central, teams should also align DLP with IAM and access review processes so data controls follow the user, the device, and the sanctioned application path.
👉 Read our full editorial: Policy-based DLP is failing under Shadow AI and SaaS workflows
