Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Last month, we brought together some of the brightest minds in cybersecurity for our Data Defense Forum event. As someone who's been in the trenches of data security for years, I walked away from these conversations with a renewed sense of urgency and optimism about where we're headed.

CSPM tools thrived by making cloud posture issues easy to find, but posture alone didn’t stop breaches. The market evolved into CNAPP – uniting posture, runtime, identity, and shift‑left – to deliver protection, not just visibility. DSPM is on the same trajectory: discovery and classification at rest are necessary but insufficient, especially as AI fragments data into shareable snippets that evade label‑centric controls.

For most CISOs, data loss prevention (DLP) has long been a familiar acronym. It’s a category of security technology that has been around for more than a decade, often associated with compliance and the need to keep regulated data under control. Yet while the concept sounds straightforward—preventing sensitive data from leaving the organization—the reality is that modern DLP platforms are far more sophisticated than their early predecessors.

AI exploded into the workplace overnight, reshaping how we work. Today, nearly every employee is experimenting with tools to move faster and think bigger. However, that acceleration comes with risk. According to Cyberhaven Labs’ latest research, nearly three-quarters of AI apps in use pose high or critical risks, and only 16% of enterprise data sent to AI ends up in enterprise-ready apps. The rest flows to personal or unvetted tools.

Confronted with a rise in sensitive data breaches, businesses are under pressure to efficiently protect their information while overcoming myriad technical limitations. In a recent video, Jon Loya, VP of Sales Engineering at Cyberhaven, shared valuable insights on the challenges of data loss prevention (DLP) and introduced Cyberhaven's cutting-edge strategies for tracking sensitive data within organizations.

Enterprise data has become nomadic. What once lived safely behind corporate firewalls now travels across dozens of cloud applications, gets copied into collaborative documents, flows through AI tools, and transforms as employees work from coffee shops, home offices, and airport lounges.

On July 23rd, the White House released America’s AI Action Plan, a sweeping federal strategy to drive U.S. leadership in artificial intelligence. The message was loud and clear: AI is a national imperative. The plan calls for removing regulatory barriers, investing in infrastructure, and accelerating AI adoption across commercial and government sectors. For data security leaders, this signals a pivotal shift.

There’s a silent frustration building inside security teams today. It’s the fatigue of defending critical data with tools that can’t keep up. The friction of investigating endless false positives. The anxiety of not knowing what sensitive data is actually doing across your environment. And the sinking realization that despite massive investments, DLP tools are failing at the one thing they were designed to do–prevent data loss.

Legacy DLP tools are blind to how data moves in today’s cloud-first world—leaving gaps attackers exploit. From shadow IT and SaaS sprawl to insider threats and misused personal devices, outdated solutions miss the subtle, high-risk behaviors that matter most. True protection requires context-aware visibility, behavioral insight, and data lineage that follows sensitive information everywhere it goes—not just where it started.

DLP emerged at a time when corporate IT environments were relatively straightforward. Employees worked primarily from corporate offices, data resided in on-premises servers, and communications happened through company-managed email systems and file shares. Traditional DLP solutions were designed to thrive in this environment.