For more than a decade, enterprise security strategies have focused on protecting data in cloud applications, SaaS platforms and network traffic. But with the advent of AI, that model is being put in reverse as sensitive information and processing is being handled by AI directly on employee devices.
During a recent SC Media webcast sponsored by Bold Security, Adrian Sanabria, host of Enterprise Security Weekly, spoke with Nati Hazut, Co-founder and CEO of Bold Security, about why organizations must reconsider endpoint data protection.
AI is bringing sensitive data back to the endpoint
Employees download proprietary information to laptops for AI-assisted analysis, software development and content creation. Meanwhile, autonomous AI agents can access local files, execute commands and communicate with external services.
Hazut said that corporate laptops are distributed repositories of sensitive information that security teams often underestimate.
"The problem starts when you have new users on those endpoints, which is the agents," Hazut said. "And they can access this data as well."
The danger extends beyond intentional employee activity. Hazut described instances in which AI agents, while attempting to complete assigned tasks, may create external accounts and upload customer information without users explicitly requesting those actions.
Agent memory introduces another complication. Sensitive information can persist in an agent's context long after its original use. Through subsequent interactions or compromised integrations, this information may become accessible to users who are not authorized to see it.
Why traditional data security tools fall short
Data loss prevention (DLP), data security posture management (DSPM) and cloud access security brokers (CASB) remain useful, but their visibility is limited.
DSPM identifies sensitive information in managed repositories, while cloud and network controls monitor supported applications and transmission channels. Neither necessarily captures local AI processing, command-line activity or communications through unfamiliar protocols.
Hazut emphasized the consequences of losing visibility when information leaves managed environments.
"If it goes to an unmanaged tool, then it's game over, right? The data already left the building," he said.
Traditional classification also presents challenges. Regular expressions and predefined patterns can identify credit-card numbers or other structured information, but proprietary source code, financial models and confidential business documents lack universal signatures.
"Vendors made us think that sensitive data is compliance data," Hazut said. "But as we know, it's not right."
Security teams therefore need to understand what information means, where it originated and whether its movement creates business risk.
Bringing intelligence and enforcement to the device
Hazut advocated endpoint-based controls that continuously map data flows, identify sensitive content and evaluate user and agent behavior.
Rather than relying exclusively on predefined classifications, AI models running locally can recognize organization-specific information and assess suspicious activity before data leaves a device.
"With the small models we did, the models are coming pre-trained over lots of synthetic enterprise data," Hazut explained, describing Bold Security's approach to local classification.
He also recommended beginning with visibility and employee coaching rather than blanket restrictions. According to Hazut, Bold Security customers average an 85% compliance rate with coaching policies that warn users before risky actions.
Organizations can then reserve blocking controls for unacceptable exposures, such as transferring production data into personal accounts.
The endpoint becomes the enforcement point
Effective AI-era data security requires more than identifying sensitive files. Organizations must correlate data lineage, application behavior, user identity and agent actions in real time.
Cloud and network defenses remain important, but endpoint enforcement provides an additional opportunity to prevent unauthorized transfers before sensitive information escapes organizational control.
