Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI exploded into the workplace overnight, reshaping how we work. Today, nearly every employee is experimenting with tools to move faster and think bigger. However, that acceleration comes with risk. According to Cyberhaven Labs’ latest research, nearly three-quarters of AI apps in use pose high or critical risks, and only 16% of enterprise data sent to AI ends up in enterprise-ready apps. The rest flows to personal or unvetted tools.

Confronted with a rise in sensitive data breaches, businesses are under pressure to efficiently protect their information while overcoming myriad technical limitations. In a recent video, Jon Loya, VP of Sales Engineering at Cyberhaven, shared valuable insights on the challenges of data loss prevention (DLP) and introduced Cyberhaven's cutting-edge strategies for tracking sensitive data within organizations.

Enterprise data has become nomadic. What once lived safely behind corporate firewalls now travels across dozens of cloud applications, gets copied into collaborative documents, flows through AI tools, and transforms as employees work from coffee shops, home offices, and airport lounges.

On July 23rd, the White House released America’s AI Action Plan, a sweeping federal strategy to drive U.S. leadership in artificial intelligence. The message was loud and clear: AI is a national imperative. The plan calls for removing regulatory barriers, investing in infrastructure, and accelerating AI adoption across commercial and government sectors. For data security leaders, this signals a pivotal shift.

There’s a silent frustration building inside security teams today. It’s the fatigue of defending critical data with tools that can’t keep up. The friction of investigating endless false positives. The anxiety of not knowing what sensitive data is actually doing across your environment. And the sinking realization that despite massive investments, DLP tools are failing at the one thing they were designed to do–prevent data loss.

Legacy DLP tools are blind to how data moves in today’s cloud-first world—leaving gaps attackers exploit. From shadow IT and SaaS sprawl to insider threats and misused personal devices, outdated solutions miss the subtle, high-risk behaviors that matter most. True protection requires context-aware visibility, behavioral insight, and data lineage that follows sensitive information everywhere it goes—not just where it started.

DLP emerged at a time when corporate IT environments were relatively straightforward. Employees worked primarily from corporate offices, data resided in on-premises servers, and communications happened through company-managed email systems and file shares. Traditional DLP solutions were designed to thrive in this environment.

Data loss prevention, or DLP as most of us know it, began as a strategy to control how information was stored and moved within organizations. Ultimately the goal was to prevent data from leaving. The premise was simple – identify where sensitive data was stored, define what could or couldn’t happen to it, and enforce those rules through network and endpoint controls. These early DLP tools relied heavily on static content inspection and then blocking or alerting based on pre-configured rules.

AI is transforming productivity across every industry—from marketing and design to legal and engineering. But while employees rush to embrace tools like ChatGPT, Gemini, and Microsoft Copilot, many are using other tools without oversight from IT or security. As this grassroots usage grows, so does the volume—and sensitivity—of data flowing into AI tools.