Topic starter
22/01/2026 3:09 pm
TL;DR: Runtime protection is presented as the missing layer for data security because static at-rest controls miss shadow data, third-party leakage, and live movement into SaaS or GenAI services, according to CrowdStrike. The real issue is identity and session exposure, not scan coverage alone, so governance must follow data in motion.
Editorial analysis by NHI Mgmt Group, based on content published by CrowdStrike: “Demystifying Data Protection in the Cloud: Runtime vs. At Rest”.
By the numbers:
- The average cost of a data breach in 2023 was $4.45 million USD, up from $4.24 million in 2022.
- Organizations took an average of 287 days to identify and contain a breach.
- 83% experienced more than one breach in 2023.
Key questions
Q: How should security teams govern personal data used by AI agents?
A: Security teams should govern agent access as a runtime control problem, not as a one-time permission decision.
Q: Why do at-rest controls fail to protect shadow data?
A: At-rest controls only see what is already in known storage locations, so they miss copies created in testing, application processing or handoff to other services.
Q: What signs show that data security is missing runtime coverage?
A: A common sign is that teams can inventory stored data but cannot explain where sensitive data went after an application, agent or user session forwarded it.
Practitioner guidance
- Map data movement paths for AI-enabled workflows Identify where AI agents, applications and users can move sensitive data into SaaS, GenAI services and third-party tools.
- Extend policy enforcement to runtime sessions Use controls that evaluate data transfers as they occur, so policy decisions follow the active session rather than the stored object.
- Close shadow data blind spots Treat unmanaged copies, developer datasets and application exports as governed assets the moment they appear.
Bottom line: Static data protection is not enough when AI agents and modern services can move sensitive information outside the managed perimeter during execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:21 pm
Runtime data protection is now an identity governance problem, not a storage problem. The article’s core point is that static protection models only govern managed repositories, while AI agents and modern services move data through live sessions and third-party destinations. That makes the decisive control question about who or what is allowed to move data, under what runtime context, and to which service. Practitioners should treat data movement as an identity event, not only a data event.
A question worth separating out:
Q: What is the difference between at-rest protection and runtime protection?
A: At-rest protection secures data where it is stored, while runtime protection monitors data as it moves between applications, services, and users. For NHI governance, runtime protection matters more when service accounts, tokens, or agents can move sensitive content into unmanaged paths that static scans never see.
👉 Read our full editorial: Runtime data protection for AI agents closes the identity gap