Adapting Your Data Security Program in the Age of AI

"Adapting Your Data Security Program in the Age of AI," a SANS First Look written by Kevin Garvey and published by SANS Institute in January 2026, examines why legacy data loss prevention (DLP) and data security programs fall short in the age of AI, and reviews how Bonfy.AI addresses those gaps. The paper is sponsored by Bonfy.AI.

Key findings:

• AI adoption expands an organization's attack surface through new integration points and data flows
• Legacy DLP programs cannot understand the business context of AI-generated content
• Shadow AI usage typically operates outside the visibility of traditional DLP solutions
• Existing data-labeling practices are often not mature enough to scale to AI inputs and outputs
• Data entered into large language models (LLMs) can contain sensitive information such as intellectual property or PII without an organization realizing it
• Overreliance on pattern matching and keyword scanning misses what the paper calls "eyes on glass governance," which requires constant manual upkeep
• Most organizations' existing key risk indicators (KRIs) and KPIs are not scoped to cover AI-related data points
• Bonfy.AI builds custom knowledge graphs by correlating data across CRM, IAM, and HRM tools to show what data is at risk and from which entity
• Bonfy.AI's entity-aware engine automates data labeling and classification, replacing manual labeling processes
• Bonfy.AI can identify both upstream and downstream risk in an information flow, covering sanctioned AI applications and unsanctioned Shadow AI alike

The paper's central argument is that bolting AI data flows onto legacy DLP infrastructure creates governance gaps rather than closing them, since those programs were built for data at rest and in transit, not for the context-dependent, constantly shifting nature of AI inputs and outputs. It frames the fix as a shift from reactive, contextless data security to a proactive, contextual model built around continuous data discovery and automated labeling. This is vendor-sponsored research content (a SANS First Look), written by Kevin Garvey and sponsored by Bonfy.AI; the underlying analysis and challenges described are SANS Institute's, while the product capabilities described are Bonfy.AI's own.