What breaks when AI data loss controls rely only on DLP and CASB?

Why This Matters for Security Teams

DLP and CASB are still useful, but they were designed for documents, email, and sanctioned cloud apps. AI workflows change the problem: the risky content is often embedded in prompts, retrieved context, embeddings, tool calls, and model outputs, not just a file in motion. That means a policy can be perfectly enforced at the perimeter and still fail to stop sensitive material from being exposed inside the application layer.

This gap matters because AI systems can reuse data in ways that are hard to classify in real time. NHI Management Group has documented that security teams need controls that inspect the interaction itself, not only the network path, and the DeepSeek breach shows how AI-adjacent exposure can quickly turn into credential and data leakage. Current guidance from the NIST Cybersecurity Framework 2.0 is to align protections to asset and data risk, not to assume perimeter inspection is enough. In practice, many security teams discover AI leakage only after prompts, connectors, or agent actions have already moved data into places their DLP rules never inspected.

How It Works in Practice

Effective AI data loss prevention has to move from file-centric controls to interaction-centric controls. That usually means inspecting prompt text, response text, retrieved documents, embeddings, and tool execution events in the AI runtime or gateway, then applying policy based on the request context. A prompt that is safe in one workflow may be unsafe in another, so simple regexes and static labels are not enough.

Practitioners are increasingly layering controls rather than replacing DLP outright. A workable pattern is to combine policy enforcement at the AI gateway with workload identity, JIT credentials for agents, and scoped tool permissions. That approach mirrors broader NHI guidance in the Ultimate Guide to NHIs — Key Research and Survey Results and the control expectations in the Ultimate Guide to NHIs — Standards. It also fits the operational direction of NIST Cybersecurity Framework 2.0, where protect and detect functions should be tied to business-critical data paths. For teams with agentic AI, current guidance suggests authorising at runtime based on intent, not only on the user or service role.

• Classify prompts and outputs for secrets, regulated data, and sensitive context before they reach the model.
• Issue short-lived credentials to agents so tool access expires when the task ends.
• Log model calls, retrieval events, and tool actions as first-class security telemetry.
• Block or redact sensitive content in the AI layer, not just at file upload or email gateways.

These controls tend to break down when AI is embedded in approved SaaS tools and agentic workflows because the dangerous transfer is semantic, not a traditional file exfiltration event.

Common Variations and Edge Cases

Tighter AI controls often increase operational friction, so organisations have to balance leakage reduction against developer velocity and user experience. That tradeoff is especially sharp when teams rely on retrieval-augmented generation, browser extensions, or copilots that touch multiple systems in one transaction.

There is no universal standard for this yet, but best practice is evolving toward context-aware authorisation and ephemeral access instead of blanket blocking. For example, some teams treat embeddings as sensitive derived data because they can preserve meaning even when the source text is absent. Others focus on agent tool abuse, where a model can chain approved actions into an unintended disclosure path. The DeepSeek breach is a reminder that AI exposure can include hidden secrets, backend credentials, and large-scale data spill, not just one leaked prompt. Security leaders should therefore test for prompt injection, connector overreach, and response leakage together, rather than assuming one CASB policy will cover all of them.

In practice, DLP and CASB become supporting controls, while the primary safeguard must be runtime policy enforcement around the model, the agent, and the credentials it can use.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on legacy DLP for AI workflows?
• What breaks when organisations rely only on native AI safety controls?
• Why do traditional DLP and CASB controls struggle with AI risk in banking?
• What breaks when employees use AI tools inside browser sessions without data controls?