A common sign is that security tools focus on storage and network transfer while missing screen, copy, paste, and prompt activity. If teams can see files at rest and emails in transit, but cannot explain where sensitive data goes inside AI assistants or browser-based SaaS, then the control gap is in data in use. That is where modern leaks increasingly happen.
Where the leakage point is usually hiding
The highest-risk gap is usually not in storage, transport, or backup systems. It is in data in use, where people and software can still see, select, copy, paste, prompt, screenshot, and forward information while working in AI assistants and browser-based SaaS. If the control story stops at files and network traffic, the monitoring model is already incomplete.
That matters because the visible “success” of traditional controls can mask live exposure. A document may be encrypted at rest and a message may be protected in transit, yet the same content can still be surfaced inside a chat window, pasted into a web form, or moved into a model prompt with no equivalent review trail.
What practitioners should look for is a mismatch between where the controls are deployed and where the data actually changes form. When the sensitive object is rendered, summarized, copied, or recomposed inside the browser, the leakage point has shifted away from classic perimeter assumptions.
Signals that the control set is missing data in use
The clearest sign is observability asymmetry. Teams can answer questions about file storage, email routing, and network egress, but cannot explain which sensitive fields are appearing in copilots, chatbots, or SaaS workflows, or who can move them from one context to another.
Other warning signals include controls that classify repositories but not sessions, policies that protect endpoints only when a file is opened locally, and alerts that never mention clipboard, screen, prompt, or browser activity. If the protection model depends on the object staying in one place, it will miss the leakage path that matters most.
At a practical level, this often shows up as overconfidence in “covered” data while users still have easy export paths. The gap is not necessarily a missing product, but a missing control boundary around interactive work.
What to check before you trust the program
Test the controls against the full data path, not just the storage layer. A credible program can explain how sensitive data is handled when it is rendered to a user, copied into another app, pasted into SaaS, included in an AI prompt, or shared through browser workflows.
For broader control design, use CIS Controls v8 to anchor inventory, data protection, logging, and access governance, and align data-use protections with the privacy and processing expectations in EU General Data Protection Regulation (GDPR) where EU personal data is involved.
If the environment includes AI assistants or browser-mediated workflows, also verify whether your governance model can describe prompt boundaries and user-visible data movement. For that subset of exposure, NIST Privacy Framework is useful for thinking about data processing, not just storage protection.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Accounts and access paths govern who can move data through interactive workflows. |
| Recommendation — Review account access paths that allow sensitive data to move through user-facing workflows. | ||
| ISO/IEC 27001:2022 | A.8.12 — Data leakage prevention | The subject is about missed leakage points and controls that fail in use. |
| Recommendation — Extend leakage-prevention controls to interactive data-use paths. | ||
| GDPR | Article 32 — Security of processing | The question concerns protection of personal data during active processing and exposure. |
| Recommendation — Assess whether security measures cover data in use, not only data at rest and in transit. | ||
| NIST CSF 2.0 | PR.DS-01 — Data-at-rest is protected | The answer contrasts static protection with the higher-risk data-in-use gap. |
| Recommendation — Pair data-at-rest safeguards with controls that address live data exposure. | ||
Practitioner Guidance
What to prioritise: Start with the workflows where users can both see and move sensitive data, because that is where leakage bypasses conventional at-rest and in-transit controls.
What to verify: Confirm that monitoring, policy enforcement, and audit evidence extend to prompt activity, browser sessions, clipboard events, and screen-based exposure, not only to repositories and email gateways.
Common mistake: Treating a strong encryption and DLP story as complete when it only protects static or transiting data. That leaves the most interactive leak paths effectively ungoverned.
Practitioner takeaway: If you cannot account for sensitive data once a person or AI tool can render it on screen, the control gap is already in the highest-risk leakage zone.
Related resources from NHI Mgmt Group
- What are the signs that insider data exfiltration controls are missing the highest-risk employee behaviour?
- Why do cloud-only DLP and DSPM controls miss the highest-risk data movements?
- Why do human error and misconfigured sharing controls create so much data leakage risk?
- Why do traditional DLP controls often fail to reduce real-world data leakage risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
