Notifications
Clear all
Topic starter
09/07/2026 1:39 pm
TL;DR: DLP programmes still depend on human memory and manual translation of judgment into policy, which breaks at scale, as Cyera says Omni DLP’s new Memories feature captures analyst judgments from alert review and reuses them in future investigations, so approved destinations, team-specific usage, and high-risk patterns no longer need to be re-explained every time.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams handle approved behaviour in DLP without creating broad allowlists?
A: Use context-bound exceptions tied to a specific user, department, or destination, then keep the approval narrow enough that it does not generalise into an enterprise-wide rule.
A: Because repeated false positives show that the organisation already knows the correct decision but has not turned that decision into a reusable control.
Q: What do teams get wrong when they let AI remember prior security judgments?
A: They often assume any stored judgment is useful forever.
Practitioner guidance
- Define exception scope by identity context Record approved behaviour at the narrowest valid level, such as user, department, or destination, so one analyst decision does not become an organisation-wide allowlist.
- Standardise analyst rationale quality Require a clear explanation for every false-positive disposition so the system can retrieve a precise memory later instead of a vague note that cannot be reused.
- Separate temporary exceptions from durable approvals Create different handling paths for one-off triage relief, team-level sanctioned behaviour, and enterprise risk posture so each can be reviewed on its own cadence.
What's in the full announcement
Cyera's full article covers the operational detail this post intentionally leaves for the source:
- How Memories attaches analyst feedback to user, department, and destination context for future alert handling
- Why precise rationale text matters when a false positive is converted into reusable system memory
- How approved-behaviour exemptions differ from org-wide risk posture changes in day-to-day DLP operations
- What analysts with alert actions permissions can review and delete after Memories is enabled
👉 Read Cyera's article on Memories for Omni DLP and analyst context reuse →
Memories in DLP: what it means for analyst judgment and policy?
Explore further
09/07/2026 1:42 pm
Analyst judgment is becoming an identity governance asset. Cyera’s feature shows that DLP teams are no longer just writing rules, they are curating repeated decisions about who, what, and where is acceptable. That is a governance pattern familiar to IAM and IGA teams: the control only becomes durable when institutional knowledge survives the analyst who made it. The implication is that decision history now needs lifecycle management, not just case closure.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Only 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations tell whether reusable DLP memory is actually improving governance?
A: Look for fewer repeated reviews of the same approved patterns, higher consistency across analysts, and lower time spent re-triaging alerts that match a clearly documented context. If the system is still arguing over the same cases every shift, the memory layer is not yet serving as durable control.
👉 Read our full editorial: Memories in DLP expose the real gap in alert triage governance
