Topic starter
12/06/2026 9:19 pm
TL;DR: Legacy DLP models are breaking as data now moves across SaaS, cloud, and AI workflows that endpoint, network, and email controls cannot fully see, according to Cyera. The architectural shift is from fragmented inspection to discovery-led data control, because perimeter-era assumptions no longer match how modern information is created, shared, and governed.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “The Great DLP Reset: Securing Data in the Age of SaaS, Cloud, and AI”.
Key questions
Q: How should security teams close the access-trust gap in SaaS and AI environments?
A: Start by measuring where users actually work, not where the identity programme assumes they work.
Q: Why do SaaS file-sharing workflows make traditional DLP less effective?
A: SaaS sharing often moves data through links and permissions rather than direct file transfer, so older DLP tools may not understand the actual sharing model.
Q: How should security teams evaluate whether DLP is keeping up with modern data flows?
A: Start by checking whether DLP coverage matches the places data actually moves, including endpoints, cloud apps, collaboration tools, and shared secrets.
Practitioner guidance
- Inventory data paths beyond the perimeter Map where sensitive data is created, copied, summarised, shared, and re-used across SaaS, cloud, and AI workflows.
- Connect discovery to classification and entitlement context Tie discovery results to the identities and service accounts that can access each dataset so policy decisions reflect current usage, not stale labels or static trust assumptions.
- Prioritise AI-mediated data flows first Focus initial DLP redesign on prompts, generated outputs, document summarisation, and cross-application sharing paths where AI changes the content lifecycle most quickly.
Bottom line: Legacy DLP breaks down when organisations rely on fixed inspection points that no longer match how data moves across SaaS, cloud, and AI systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
12/06/2026 11:18 pm
Legacy DLP failed because it was built for fixed inspection points, not fluid data journeys. When information moves across SaaS, cloud, and AI workflows, the old assumption that security can watch the edge and infer the rest stops holding. The result is not just blind spots, but a governance model that misreads where data actually lives and how it is used. Practitioners need to treat discovery as the starting condition for DLP, not an add-on.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: What should organisations do first when rebuilding DLP for cloud and AI environments?
A: Organisations should start by discovering where sensitive data is created, copied, and reused across applications and AI workflows. That gives them the context needed to prioritise controls, map access paths, and decide where legacy inspection points still work. Without that inventory, DLP redesign will remain guesswork.
👉 Read our full editorial: The great DLP reset for SaaS, cloud and AI environments
This post was modified 3 days ago by NHI Mgmt Group