Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A data loss prevention (DLP) team writes a rule to keep customer records out of ChatGPT. The rule catches an uploaded spreadsheet but misses the same records pasted into a prompt, because no file transfer occurred. The team adds text pattern matching to close the gap, and the rule starts flagging harmless prompts that happen to contain a name and a number. Both failures share one cause. The rule judges what the text looks like and cannot see where it came from.

“Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data.” Security teams read headlines like this every week. When they learn about new threats from sources like CISA Cybersecurity Alerts & Advisories, each one prompts a check on whether current tools cover it. And as these new threat vectors get published, some expose gaps that existing tools can’t cover. Teams respond by searching for products to address these risks.

A well-written AI policy is where governance starts. It gets legal, security, and the business aligned on how much risk the organization is willing to accept, and nothing else in the program works without it. Every AI policy ultimately exists to protect the data held by the organization. In today’s world, data held in information systems is the crown jewel of most organizations but the same data can put the organization at risk if it leaks, gets stolen, or is mishandled.

At Cyberhaven, we replaced our previous LLM-based approach to document understanding with a small model that makes 83% fewer decision errors at less than 1% of the inference cost. We achieved this by breaking complex tasks into simpler decisions, using uncertainty as a training signal, and heavily optimizing our inference stack. The model produces calibrated decision probabilities while preserving multimodal understanding and generative capabilities.

An AI support agent picks up a customer case, signs in with valid credentials, works on it in only approved systems, and closes it. I would reasonably predict that if someone were to review this workflow, it would likely come back clean, with no policy rule violation. But if we were to take a closer look, we might find that the agent did more than just close the case.

Security teams built their controls around people, applications, devices, and networks. AI agents operate across all four at once. An agent can pull records from Salesforce, combine them with financial data, summarize the result with a language model, and post it to Slack, with no person touching any step. Each action may look permitted on its own, which means the risk sits in the sequence, and most tools can’t see the sequence.

Data loss prevention (DLP) has been around for decades. But the way data moves today looks very different from the environment traditional DLP was built to protect. That change comes through clearly in the new Market Overview for Data Loss Prevention by Gartner. We see that Gartner describes a mature market undergoing significant evolution, with cybersecurity leaders increasingly looking for DLP that is adaptive, policy-driven, risk-based and AI-enhanced.

An AI agent produces a recommendation that looks reasonable. It's accurate. The model didn't hallucinate. Can the organization trust it? That depends on questions the output can't answer: Enterprise trust requires knowing where information came from, how it moved, what happened to it, and whether the process behind the result deserves confidence. Provenance is where that trust starts.

Every audit season, a governance, risk, and compliance (GRC) team pulls access reports, screenshots configurations, and reconstructs months of data handling from whatever logs survived. The package passes the audit, but the evidence is stale a week later.