Topic starter
08/06/2026 5:05 pm
TL;DR: AI applications are expanding enterprise data exposure by pulling in emails, chat logs, legal documents, and cloud files, while legacy classification and access controls struggle to keep up, according to Cyera. The governance problem is now less about storing data than knowing what AI can reach, classify, and expose before that reach becomes a breach.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “The Role of AI and ML in DSPM”.
By the numbers:
- The total volume of data is expected to reach 181 zettabytes in 2025.
- Cyera says its classification approach achieves 95% precision.
Key questions
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Q: Why do legacy data classification tools fail for generative AI use cases?
A: They were built for more structured data and rely heavily on manual tagging or pattern matching, which performs poorly on unstructured content.
Q: What is the difference between access control and data governance in AI environments?
A: Access control decides which identities may reach a system or dataset.
Practitioner guidance
- Inventory AI-connected data paths Map which SaaS, cloud, on-premises, and AI applications can reach sensitive repositories, then document the effective data scope for each path.
- Classify unstructured data at file level Replace regex-heavy, manual classification workflows with automated file-level sensitivity detection for text, images, video, and mixed-content stores.
- Treat AI tools as non-human identities Assign ownership, access reviews, and offboarding logic to generative AI tools that can read or expose enterprise content, especially where Copilot-like integrations are present.
Bottom line: AI security now depends on understanding what data AI tools can reach, not only where that data is stored.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
08/06/2026 7:04 pm
AI security has become a data visibility problem, not a model problem. The article is right to move the centre of gravity from the AI system itself to the data estate it can reach. In practice, the exposure path is often inherited from broad content access, not from flaws in the model. The implication is that governance teams must measure reachability before they can measure risk.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What should organisations prioritise first when securing AI data exposure?
A: Prioritise discovery and classification before expanding AI use cases. If teams cannot identify sensitive unstructured data and the AI-connected paths to it, they cannot apply meaningful access control, retention, or blast-radius limits to the systems consuming that data.
👉 Read our full editorial: AI security depends on data visibility in DSPM and governance
This post was modified 1 day ago by NHI Mgmt Group