Topic starter
25/10/2026 11:04 am
TL;DR: Only 9% of organisations surveyed have robust scanning, and 23% cannot scan unstructured data at all, Securiti’s survey found. Unstructured data governance has to cover discovery, ownership, and enforcement before AI systems can consume sensitive information.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “Data‑First Security Strategies for Enterprise AI”.
By the numbers:
- Only 9% of organisations surveyed in the Cloud Security Alliance’s 2026 report on unstructured data have robust scanning capabilities, according to Securiti.
- 23% cannot scan unstructured data at all, according to Securiti.
Key questions
Q: Why do AI programmes fail when data visibility is incomplete?
A: AI programmes fail because models and agents can reach sensitive information faster than teams can identify, scope, and control it.
Q: What are the signs that AI governance is too fragmented to support scale?
A: Common signs include duplicated governance tools, inconsistent policies across business units, and teams managing AI or data controls in isolation.
Q: How should security teams govern sensitive data used by AI systems?
A: Security teams should treat AI as a data consumer that needs policy boundaries, not just authentication.
Practitioner guidance
- Map sensitive data flows before AI ingestion Inventory where sensitive data resides, how it moves, and which AI systems can reach it before models or agents consume it.
- Establish evidence-bearing governance controls Replace policy-only approvals with controls that can demonstrate scanning coverage, access decisions, and enforcement for AI data paths.
- Prioritise unstructured data discovery Focus first on repositories and document stores that AI search, copilots, and agents can ingest without structured schema protections.
Bottom line: Enterprise AI governance now depends on controlling sensitive data before models and agents can access it, not after they have already consumed it.
Glossary terms: Data-First Security, Data Flow Mapping, Unstructured Data Governance, Evidence-Bearing Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:17 pm
Data-first security is the governing assumption enterprise AI now depends on. AI systems do not merely expose existing data risk more quickly. They change the point at which risk becomes operational, because sensitive data can be ingested, retrieved, and recombined before conventional oversight catches up. The implication is that AI governance must start with the data estate, not with model review after deployment.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should organisations prioritise AI data governance before scaling AI adoption?
A: Yes. Organisations that scale AI before establishing discovery, classification, monitoring, and policy enforcement are effectively expanding the attack surface faster than they can govern it. AI adoption should be matched with controls that follow the data lifecycle, otherwise compliance, exposure, and misuse risks compound as usage grows.
👉 Read our full editorial: Unstructured data visibility now sets the pace for enterprise AI
This post was modified 7 days ago by NHI Mgmt Group