Topic starter
02/06/2026 7:03 pm
TL;DR: AI governance breaks down when data is dispersed across SaaS, cloud, and on-prem environments, and when non-human identities can reach sensitive data faster than manual controls can track, according to Cyera. The practical shift is from policy-only governance to continuous discovery, permission right-sizing, and runtime protection as the baseline for control.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “What Keeps CDOs Up at Night: The Visibility Gap”.
Key questions
Q: How should security teams govern AI agents that reason across multiple data platforms?
A: Security teams should govern the meaning layer, not just the access layer.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Establish continuous data discovery Map where sensitive data resides across SaaS, cloud, and on-prem systems, then tie each location to the identities and tools that can reach it.
- Right-size human and NHI permissions Review service accounts, embedded AI integrations, and user access together so overprivileged identities do not expand the blast radius of AI-enabled workflows.
- Classify sanctioned and shadow AI tools Maintain an inventory of approved and unapproved AI tools, then document which datasets each tool can access before it is used in production workflows.
Bottom line: AI governance breaks when organisations cannot continuously see where sensitive data lives or which identities can reach it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 7:21 pm
AI governance now fails at the boundary between data visibility and identity scope. Cyera's analysis shows that the central problem is no longer whether governance exists, but whether the organisation can observe how data is actually reached and moved. When access paths change faster than review cycles, policy becomes documentary rather than operative. The practitioner conclusion is that governance must be judged by observable behaviour, not declared coverage.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: They should move enforcement closer to the workflow by combining continuous discovery, right-sized permissions, and runtime protection. That reduces the chance that a prompt, retrieval, or response can expose data before a reviewer notices the access pattern.
👉 Read our full editorial: AI governance is failing where data visibility and NHI access collide