Activate All Your Data. Accelerate All Your AI.
The pilot works. The review is where it stops.
Most enterprise agentic AI programs are not short of capability. They are queued. The pilot demonstrates well, the business case holds, and then the work enters security and compliance review and comes out late, narrowed, or both.
That review exists for a reason. The executive who signs the approval carries the breach liability, and in Enterprise Management Associates research the CISO is the most common approver for moving AI into production, named by 47.4% of respondents. Add the CIO and CTO and the three of them account for 83% of approvals. The people asked to approve agentic access to regulated data are the same people who answer for it afterward. Caution is in the job description.
The difficulty is that the control question in front of them cannot be answered with the evidence available, and intake has grown faster than the process built to handle it.
“We cannot review 200 applications within a one month period.”
· Cybersecurity manager, media and entertainment
“A form is not scalable, and certainly a finite number of bodies on that governance committee are not going to be able to keep up with the exponential growth we are seeing in demand for evaluating the security of new products.”
· CISO, global consumer goods
Quotations throughout are drawn from sixteen practitioner interviews commissioned by Protegrity and conducted independently, attributed by role and sector.
What the delay costs
EMA surveyed 150+ IT and security leaders in Q2 2026 and named the result an AI friction tax: the accumulated drag that security reviews, compliance processes and data access approvals impose on AI programs. The study was sponsored by Protegrity and conducted independently.
- 83% agreed or strongly agreed that security or compliance reviews have delayed AI projects from moving into production.
- 82% had deployed AI agents in a diminished state at least occasionally because of security concerns. For 43% it happens routinely on high-value projects.
- Among the organizations reporting delays, two-thirds waited a month or longer and nearly 30% waited four months or more.
- Roughly 88% are increasing agentic AI budgets by 10% or more.
The AI friction tax, in the survey’s own numbers
Three findings describe the delay. The fourth explains why it compounds.
Investment is running well ahead of delivery. In most software categories a four-month slip is an inconvenience. In AI it means shipping against a different competitive baseline than the one the business case was written for, on model assumptions and unit costs that have already moved.
The more useful finding is what these leaders want from fixing it. Asked to name the primary business outcome they are seeking from better AI data security, 47.4% chose reducing manual audit and compliance operating costs. Faster time to revenue came second, at 24.3%. The market is selling speed to buyers who are asking for relief from compliance overhead.
Why the control question cannot be answered
Least privilege was set out by Jerome Saltzer and Michael Schroeder in a September 1975 paper: every program and every user of the system should operate using the least set of privileges necessary to complete the job. Zero trust, introduced by Forrester analyst John Kindervag around 2010, added continuous verification of every request. Both principles are sound, and both remain in force. Neither is what has broken.
What changed is the unit of analysis. Least privilege evaluates an identity against a request, which works when the requester is a person or a service doing a predictable thing. An autonomous agent declares its purpose at the start and discovers what it needs as it works, issuing requests faster than a reviewer can follow, and assembling across them.
Each request is unremarkable. The combination is the exposure.
That is the line where data security and knowledge security separate. A single field is a data question, and access control answers it well. What an agent assembles across fields, systems and turns is a knowledge question, and no permission model answers it, because the sensitive result never existed in any one record that could be classified, labeled and governed.
Every permission is legitimate. The combination is not.
Least privilege evaluates each request on its identity making it. Nothing in that model can see what the requests add up to.
One security leader described the mechanics of it inside their own environment:
“A relatively simple query that Copilot kicks off in an email could talk to your SharePoint, which is over-provisioned, which could talk to your data lake, which is over-provisioned, and then all of a sudden you have got data that the unwary might be including in a pivot table or an email that is not necessary.”
· CISO, healthcare and clinical research
This is why the review takes a month. The reviewer is being asked whether an agent can be trusted with access, and access is the wrong unit of analysis, because no inventory of permissions predicts what an agent will assemble once it holds them all. Faced with that, a reasonable reviewer does the only thing available: narrow the scope, insert a human approval step, or defer. EMA found roughly one agent deployment in five running with high autonomy, and close to half confined to preapproved scopes.
That is what the diminished state looks like in an operating model, and it is the predictable output of asking an identity question about a reasoning system.
Zero exposure
Zero exposure is an architectural property rather than a promise about outcomes. Sensitive values in clear text are not carried in the workflow for an agent, a log, an index, an embedding or an intermediate result to expose. Protection is applied where the data lands, it travels with the field, and clear values resolve only for the parties policy authorizes, and only where policy allows.
The word is deliberate. Harm and loss describe damage already done. Exposure is the event that precedes both, and it is the one an architecture can remove rather than mitigate.
It does not replace least privilege or zero trust. Those controls carry on operating exactly as they do today. What changes is the consequence when one of them fails. Where protection is a property of the data rather than a gate in front of it, a mis-scoped permission, an over-provisioned share or a compromised credential returns protected values. In control language, it is a compensating control that lowers the impact of every access failure at once, which is also why it tends to survive a joint review.
A security architect in healthcare software put the economics of that plainly:
“If you can make that data boring, then you do not need to spend a bajillion dollars getting to 99% efficacy with preventing unauthorized access to data.”
· Technical CISO, healthcare software
What survives protection
The standing objection is that protected data is useless data. That holds for the blunt methods. Storage-layer encryption and dynamic data masking are the two most widely used approaches in EMA’s data, at 57.2% and 56.6% of respondents, and neither leaves a field an agent can compute with.
Field-level protection behaves differently. It preserves type, format, length and referential relationships, so a record still fits the schema it came from and still joins to the same entity across systems. Which method applies to which field is a policy decision: vaultless tokenization, format-preserving encryption, generalization, masking or synthetic data.
Protected values keep the properties an agent computes with. What they lose is the value itself.
What zero exposure does not claim
Three limits, stated plainly, because a paper that claims everything is believed on nothing.
- Residual risk does not reach zero. No architecture achieves that. What changes is that exposure stops being the default state every other control is working against.
- Governance does not go away. It changes what governance is asked to approve, from a judgment about an agent’s trustworthiness to a property of a workflow that can be evidenced.
- Nothing is protected that has not been found. Discovery and classification remain prerequisites, and an unclassified field is an unprotected one.
What it looks like in practice
Two scenarios, each carried from the knowledge at stake through to the evidence the reviewer receives.
Warranty analysis at a manufacturer
The knowledge at stake. The failure pattern by part, batch and model. No single claim is worth anything. The correlation across a hundred thousand of them is worth a great deal, to a competitor and to a plaintiff’s counsel.
What the team needs to do. Join warranty claims to returns and to production records and let an agent find the pattern. Those three systems have three different owners and carry customer names, addresses and payment details alongside the engineering data.
What is actually seen. The agent works on protected values. Identifiers still join the same customer across all three systems, so the correlation resolves, while clear names, addresses and card numbers stay out of the agent’s context, its intermediate results and its working set.
What the audit trail proves. Which policy applied to which field, which values resolved in the clear, for whom, and at which step. The reviewer receives evidence rather than an assurance, which is what shortens the next review as well as this one.
Cross-border analytics at a global bank
The knowledge at stake. Which customer segments respond to which offers, across markets. The segmentation logic is the asset. The personal data underneath it carries the regulatory exposure, and both sit in the same query.
What the team needs to do. Analyze customer records held in several countries without moving personal data across borders and without exposing it to teams outside each jurisdiction. GDPR is the most frequently cited framework in EMA’s data, and the median respondent is managing three regimes at once.
What is actually seen. Records are protected in the jurisdiction where they land, in a form that still joins and still segments, so the analysis runs across every market while personal data stays inside its home country in readable form.
What the audit trail proves. That residency held, that per-jurisdiction policy was enforced, and that every resolution to clear text is logged against a named authorization. That is the evidence a regulator asks for, and it is the same artifact that answers the internal exception process.
What it changed at a top five global bank
A top five global bank serving more than 200 million customers across 160 countries was working under 130 or more privacy regimes, facing a choice between duplicating infrastructure in every country, paying in-country processors, or giving up cross-border analytics. It took none of the three. Protection endpoints were automated and the request path was integrated into ServiceNow, so a developer could request, receive and use data protection for a specific application within minutes. In the bank’s own account, the agility, flexibility and strength of protection delivered allowed developers to avoid lengthy security reviews and accelerate apps to market.
What that produced: global production rollout in six months, three months ahead of schedule; enterprise-wide analytics across more than 200 million customers; more than $20 million removed from infrastructure and data processor costs; and $18 million of net new revenue over five years.
A second institution, a multinational financial services provider, described the same shift in different terms: access to 100% of its sensitive data after migrating to the cloud, against 30% before.
Who this pays off for
The same architecture produces two different arguments depending on who is asking, which is the reason it tends to clear a joint review that other proposals do not.
| For the AI and data leader | For the security and compliance leader |
|---|---|
| Pilots reach production instead of stalling in review | The control question is answered once at the architecture level rather than per dataset |
| Agents run at full capability rather than a diminished subset | Clear-text sensitive values are kept out of the agent’s context |
| Reasoning happens over the whole dataset, not the part that cleared review | Policy is set centrally and enforced wherever the field travels |
| New data sources and models are added without restarting the approval cycle | Every resolution to clear text is logged against a named authorization |
| Budget already committed starts returning value sooner | Residency and jurisdiction rules hold without manual workarounds |
The right-hand column is the one EMA’s respondents ranked first. Reducing manual audit and compliance cost beat faster time to revenue by nearly two to one.
Why this is hard to do any other way
Four adjacent categories each solve a real part of this problem. None of them reaches the data itself, which is why they combine well with enforcement at the data layer rather than substituting for it.
| Category | What it does well | Where it stops |
|---|---|---|
| Posture and discovery | Finds sensitive data across the estate and reports where it sits and who can reach it | Reports and alerts. It does not change the data, so the exposure it finds is still there after the finding |
| Identity and access control | Decides who or what may reach a system, and is the layer least privilege and zero trust already cover | Does not change what the data looks like once access has been granted. Allow or deny is the only decision available |
| Masking and redaction | Changes what a requester sees, and works well for reports and dashboards | Tends to break the joins and correlations an agent depends on, so an agent handed masked data often returns a worse answer rather than a safer one |
| Synthetic data | Removes the sensitive original altogether, and is a strong fit for testing and model training | A weak fit when the answer has to be true of real customers, real shipments and real claims |
| Runtime guardrails | Inspect what an agent is asked and what it returns, and are part of what this approach requires | On their own they police the conversation rather than protect the data underneath it |
What enforcement at the data layer adds is the part none of them reach. The data carries its own protection, in a form that still computes, from the moment it lands to the moment a result is delivered. That is what makes the other four dependable rather than best effort.
One deputy CISO drew the boundary in a single line:
“You are not going to replace the tools that are there. You complement them. In terms of its treatment, we have not gotten to that phase yet.”
· Deputy CISO, global media and advertising
Discovery and classification are widely deployed. Treatment, in most enterprises, is not. That gap is the whole opportunity, and it is why the honest posture in every one of these conversations is complement rather than replace.
Why now
Budget is not the constraint. IDC forecasts AI security spending rising from $30.4 billion in 2025 to $105.6 billion in 2029 (Worldwide AI Security Spending Forecast, March 2026). Roughly 88% of EMA’s respondents are raising agentic AI budgets by 10% or more, while 82% report agents already running in a diminished state. The money has arrived ahead of the capability it was meant to buy.
Assurance has not arrived with it. Grant Thornton found in 2026 that 78% of executives are not confident they would pass an independent AI governance audit within 90 days. That is a control gap with a board-level audience attached to it, and it does not close by adding another review.
There is a narrower reason to move now, and it comes from the same survey population. Nearly four in ten of these leaders want protection embedded at the developer level, delivered as an SDK, a container, or modules running directly in developer workflows. That is a shift in where security is expected to sit, from a gate in front of the pipeline to a property inside it, and it is being asked for by the people who currently run the gate.
The decision this changes
Nothing here asks a security team to lower a standard or give up a control. It changes the question asked at the review.
Today the question is whether an agent can be trusted with sensitive data. That cannot be answered with confidence, which is why the answer takes a month and arrives narrowed. The question this architecture puts in front of a reviewer is whether a workflow in which sensitive values are never surfaced in the clear is acceptable. That is a question about a property of the system rather than a judgment about intent, it can be evidenced, and it can be answered once.
That is what activating all your data means in practice. Less exposure, so access stops being the thing that has to be rationed.
To learn more, visit protegrity.com.