Topic starter
07/06/2026 8:06 pm
TL;DR: Traditional perimeter and access controls no longer answer where sensitive data lives, who can access it, or how it is protected, according to Cyera’s report based on real-world data risk assessments. The finding is a reminder that data governance, identity control, and exposure management now have to be treated as one problem, not separate programmes.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Top 5 Findings from Cyera Data Risk Assessments”.
Key questions
Q: How should security teams govern access when sensitive data is spread across multiple systems?
A: Security teams should classify the data first, then use that classification to drive entitlement review, certification cadence, and revocation logic.
Q: Why do traditional access controls fail to protect sensitive business data?
A: Because they answer only who can log in or reach a system, not where sensitive data lives or how broadly it can move once accessed.
Q: What are the signs that a data security assessment is missing the highest-risk exposures?
A: Warning signs include a long list of findings with no prioritisation, unknown data repositories, unclear effective access, and remediation plans that stop at reporting.
Practitioner guidance
- Define a shared data-access inventory Link sensitive data discovery results to the identities that can reach each dataset, including service accounts, tokens, and application identities.
- Reconcile entitlement scope with data sensitivity Review whether each access path is justified by the classification of the underlying data, not only by the user role or system permission.
- Surface machine access routes to data Map NHI credentials and service accounts to the data stores they can query, sync, or export so broad access becomes visible to governance teams.
Bottom line: The core problem is not only data sprawl, but the inability of traditional controls to explain where sensitive information lives and who can reach it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/06/2026 9:52 pm
Data exposure is now an identity governance issue, not a storage issue. Traditional data security models still separate discovery, classification, and access governance, but those layers fail when the same dataset is reachable by humans, service accounts, and AI-connected workflows. The practical consequence is that entitlement review without data context creates false confidence. Practitioners should treat data location and access scope as a single governance object.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise data discovery or access governance first?
A: They should do both together, but discovery usually comes first when the estate is not well understood. Without knowing where sensitive data resides, access governance becomes a partial exercise that misses the highest-risk datasets. Once discovery is in place, teams can align privileges to actual exposure rather than assumptions.
👉 Read our full editorial: Cyera data risk assessments expose gaps in data security