Topic starter
09/07/2026 12:38 pm
TL;DR: The mismatch between traditional access controls and AI-layer data exposure is the core issue, not AI adoption itself; Gartner named Knostic a 2025 Cool Vendor in AI Cybersecurity Governance for its topic access governance approach, which targets AI oversharing risk across Copilot, ChatGPT, and agentic environments while integrating with Purview, DLP, and DSPM workflows, according to Knostic and Gartner.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “Knostic Named the 2025 Gartner Cool Vendor in AI Cybersecurity Governance”.
Key questions
Q: How should security teams govern AI assistants that can access audit data?
A: Treat them as privileged non-human identities with defined scope, logging, and approval boundaries.
Q: Why do traditional access controls fall short for enterprise AI governance?
A: Because they were built to decide access to records, not to govern how an assistant transforms records into answers.
Q: What are the best signs that AI oversharing risk is not being controlled well?
A: Look for assistants that can answer sensitive questions with details users could not reasonably retrieve through normal application workflows.
Practitioner guidance
- Map AI response exposure boundaries Document which prompts, topics, and connected sources can cause an assistant to reveal information beyond direct source access, then classify those exposures by sensitivity and business context.
- Align DLP and DSPM with AI interactions Extend existing data security policies so they evaluate retrieved content and generated responses, not just stored data and transport controls.
- Define topic-level approval rules Create rules for high-risk topics where AI responses must be blocked, narrowed, or redacted before delivery to the user.
Bottom line: AI assistants create a governance problem that goes beyond source-system permissions because they can expose more than the underlying application would.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:44 pm
AI cybersecurity governance is becoming a distinct control plane, not a branding layer. The article shows that enterprises are no longer just securing models or repositories; they are securing the data exposure path created by AI interaction itself. That changes the unit of governance from access to answer, which is why AI governance now sits alongside IAM, DLP, and DSPM as a separate decision surface. Practitioners should treat AI exposure governance as an operating discipline, not a pilot.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations prioritise governance over more AI pilots in healthcare?
A: Organisations should prioritise governance when data quality, provenance, or workflow fit is inconsistent across care settings. If the same information cannot be trusted across hospital, outpatient, home, and device-generated contexts, more pilots will increase complexity faster than value. Governance becomes the bottleneck because it determines whether AI can scale safely.
👉 Read our full editorial: Knostic's Gartner cool vendor recognition and AI governance gap