Topic starter
04/06/2026 6:44 pm
TL;DR: The security problem is no longer raw access volume, but unmanaged AI-mediated data exposure that existing controls cannot reliably see or classify; Cyera says its Omni DLP integration with Anthropic’s Claude Compliance API brings auditable visibility to Claude Enterprise conversations, files, and user activity, while Cyera Research found workers use only about 4% of the access they are granted.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Cyera and Anthropic integrate to bring real-time AI security to Claude Enterprise”.
By the numbers:
- Cyera Research analyzed 2.4 million workers and found that employees use about 4% of the access they've been granted.
- Employees use about 4% of the access they've been granted, leaving 96% dormant long enough to be overlooked by traditional monitoring.
Key questions
Q: What breaks when AI tools are allowed broad write access to internal systems?
A: Broad write access turns an AI tool from a helper into an unreviewed operator.
Q: Why do autonomous AI agents increase insider risk even when access is technically authorized?
A: Autonomous agents increase insider risk because authorization alone does not explain purpose.
Q: How can security teams tell whether AI lifecycle controls are working?
A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current.
Practitioner guidance
- Map AI interaction logs into DLP coverage Treat Claude conversations, attached files, and generated outputs as monitored data flows so investigations can reconstruct what was shared and when.
- Correlate AI activity with identity telemetry Join AI usage, database queries, file downloads, and user identity signals so suspicious combinations surface as one case instead of isolated events.
- Classify sensitive data in context Use context-aware classification for PII, PHI, and financial data so legitimate work does not trigger noise while risky prompts still escalate.
Bottom line: AI-mediated workflows can expose sensitive data in places where traditional DLP and audit controls do not have enough context to interpret the risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 6:56 pm
AI visibility is now a data governance control, not an optional overlay: The article shows that Claude-style interaction surfaces can expose sensitive data in ways that storage-centric controls never modelled. That is a governance shift for DLP, insider risk, and audit teams, because the unit of analysis is no longer just the file or record. Practitioners should treat AI interaction logs as first-class evidence.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What is the difference between access granted to users and data exposed through AI?
A: Granted access is a permission state. Exposed data is the subset that becomes visible through a real workflow, which may include AI prompts, attachments, summaries, and downstream sharing. AI can widen the practical exposure surface without changing the entitlement record, so governance has to measure effective use, not just assigned access.
👉 Read our full editorial: Claude Enterprise visibility exposes the AI data governance gap