COMMENTARY: Security teams have long focused on safeguarding data in SaaS applications, browsers and cloud services. In other words, where employees worked and processed company data. Those very same teams relied on data loss prevention (DLP) systems to protect that data, relying on rules, patterns and labels to identify sensitive information and track where it went.
But AI makes this process infinitely harder because employees and agents can work with more data, much faster. An agent alone can search dozens of files, pull information from several applications and use all of it to complete a single task. Much of that work now runs in desktop AI applications and agents that execute locally, on the device itself. This means security teams now have far more data to track, and a smaller window to decide what to do about it.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
Most data protection tools also sit in the wrong place. Network, cloud, and browser controls inspect data as it crosses a gateway or enters a sanctioned application. A file created on a laptop and sent from a desktop application never crosses either one. The one layer they structurally cannot reach: the device.
Then there’s the data itself. To safeguard what matters, security teams need to know what’s actually sensitive, and traditional DLP just wasn’t built for that. Legacy systems can recognize information that follows a known pattern, like a credit card or Social Security number, but they have a hard time with source code, financial projections, or an internal strategy document.
Without knowing what the data consists of, a tool has two settings. Block on the patterns it can recognize, and legitimate work gets stopped, so people find a way around it. Monitor only, and the alerts pile up while the data keeps moving. Most teams pick the second, which means the tools bought to prevent data loss end up documenting it. Prevention has always been the point.
AI gives security teams a better way to classify data
AI has become part of the problem, but it’s also the solution. Here’s what I mean: Take a financial forecast as a quick example. A traditional DLP may see it as an unremarkable spreadsheet unless a rule or label tells it otherwise. AI, on the other hand, has the ability to semantically understand that the file contains confidential financial information and company IP and treat it accordingly. The same goes for other sensitive data without an obvious marker.
In theory, this should also result in fewer alerts. If security can better identify the data that actually needs protection, it doesn’t have to flag every file an agent touches or every action that looks unfamiliar. As a result, security analysts can focus on the cases where company data is actually at risk.
Where that classification happens matters as much as the classification itself. If a file has to travel to a cloud service for someone to read it, the verdict comes back only after the data has left the device. Reading the data on the device (semantically with AI, of course) has become the only way to actually do what DLP was designed to do: prevent.
Security needs to know what happened to the data
Because so much work now happens on the employee’s device, endpoints are the best place to see what happens to the data before it ever leaves. They can see where the data came from, how it changed along the way, and where it’s going.
For example, if an employee takes information from a confidential financial forecast and moves it into an AI application, network and cloud tools may only see the data as it leaves the device. The endpoint can see where that information came from and where it’s going, giving security the context to understand what’s actually happening and decide whether to allow it or block it. The goal: block risk without getting in the way of legitimate work.
The decision has to happen quickly to make that happen. Agents can move through dozens of files and applications in the time it takes an employee to complete a single task, creating far more activity after the fact for security analysts to triage and investigate. Treating every action as a separate event to review later only creates more alerts without necessarily telling analysts whether sensitive data is actually at risk.
By the time anyone realizes that confidential IP or customer records went somewhere they shouldn’t, the data has left. Security needs to make that call while it still has a chance to stop it.
Data protection starts where employees handle the data
So where does this leave security teams? They need to focus more closely on the endpoint, where employees and agents are increasingly working with sensitive data and the last point where security still has a chance to protect it.
This requires understanding the data itself and following what happens to it. AI can help determine whether there’s sensitive data involved, while the endpoint can show what someone or something does with it. Together, they give security enough context to decide whether to prevent that data from leaving the device.
And ultimately, that’s the goal. As employees and agents work with more sensitive company data, security needs to make better decisions about what can move and what needs to stay put, before sensitive data ends up somewhere it shouldn’t.
Nati Hazut, co-founder and CEO, Bold Security
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
