Why do organisations struggle to keep sensitive data protected as AI adoption, insider risk, and data sprawl increase?

Why This Matters for Security Teams

AI adoption, insider risk, and data sprawl are converging into the same operational problem: sensitive data is now copied, transformed, and re-exposed across more systems than most governance models can reliably track. As NIST Cybersecurity Framework 2.0 frames it, protection depends on knowing where critical information lives and which controls are actually enforceable at the point of access. In practice, many organisations discover the gap only after a SaaS workflow, endpoint sync, or AI assistant has already propagated the data beyond its intended boundary.

This is why identity scope matters as much as data classification. When a human user, service account, or AI agent can reach too much data too easily, the organisation loses the ability to distinguish normal business use from harmful reuse. NHIMG research on the Ultimate Guide to NHIs — Why NHI Security Matters Now shows how quickly identity sprawl becomes a security issue once machine access outgrows manual review. In practice, many security teams encounter data exposure only after an AI workflow or over-privileged identity has already moved it into a place they were not monitoring.

How It Works in Practice

Effective protection starts with discovery, but discovery alone is not enough. Sensitive data must be classified, mapped to business context, and tied to the identities that can access it. That includes employees, contractors, service accounts, API keys, and AI systems acting with execution authority. The relevant question is not only “where is the data?” but also “who or what can touch it, under what conditions, and with what downstream tool access?”

Operationally, strong programmes combine policy, telemetry, and enforcement:

• Discovery and classification identify regulated, confidential, and operationally sensitive data across endpoints, SaaS, cloud storage, and collaboration tools.
• Identity and access reviews reduce broad entitlements, stale permissions, and shared credentials that obscure accountability.
• Context-aware controls apply restrictions based on device posture, location, sensitivity, and task purpose rather than a single static role.
• Data loss prevention, token controls, and egress monitoring reduce accidental or malicious movement into AI tools, chat systems, and external repositories.

This is especially important for non-human identities. NHIMG’s The 2024 ESG Report: Managing Non-Human Identities reports that 72% of organisations have experienced or suspect a breach of non-human identities, which is a useful reminder that machine access can become the fastest route to data exposure. For controls to hold, they must be enforced through mechanisms such as least privilege, short-lived secrets, and policy at request time, not just annual access certification. NIST SP 800-53 Rev. 5 reinforces this through access control and information flow expectations, but current guidance suggests the enforcement layer must now account for AI-assisted workflows as well as traditional users. These controls tend to break down when sensitive data is freely copied into unmanaged AI tools because the organisation loses both visibility and enforcement at the moment the data is reused.

Common Variations and Edge Cases

Tighter data controls often increase friction for employees and analysts, requiring organisations to balance usability against the need to prevent overexposure. That tradeoff becomes sharper when AI copilots, automation scripts, and cross-platform integrations are part of normal work. The best practice is evolving, and there is no universal standard for this yet, but many teams are moving toward policy tiers that treat highly sensitive data differently from ordinary business content.

Edge cases matter. For example, a file may be harmless in isolation but risky once an AI tool can summarise it, extract it, and redistribute it into another workflow. Similarly, insider risk is not limited to malicious intent; well-meaning users often overshare data because the tools make sharing too easy. NHIMG’s Top 10 NHI Issues and OWASP NHI Top 10 both reinforce that machine identities and agentic workflows need tighter governance than traditional app access. The practical takeaway is to treat data protection as a living control problem, not a one-time classification exercise, especially where AI systems can amplify a small access decision into broad data sprawl.

Related resources from NHI Mgmt Group

• Why do organisations struggle to keep sensitive data protected as it moves through modern applications?
• How can organisations reduce risk when deploying AI assistants with sensitive data access?
• How should teams manage insider risk when AI agents have legitimate access to sensitive data?
• Why do AI agents increase the risk of oversharing sensitive data?