Data discovery and classification are becoming important considerations as enterprises bring AI into their operations. Security teams need to understand what information is available to AI systems and how access is governed.
Data discovery and classification are becoming important considerations as enterprises bring AI into their operations. Security teams need to understand what information is available to AI systems and how access is governed. Turning AI trust and cyber resilience principles into practical controls presents a challenge for organizations, according to Jon Oltsik (pictured, right), principal analyst in residence at SiliconANGLE and theCUBE.
“A policy is a policy,” he said. “You write a policy down, you put it on a piece of paper, you educate people. But then when it comes to policy enforcement, that becomes much more difficult. That’s where your controls have to be in place.”
Oltsik and theCUBE Research’s Krista Case (left) provided a day-two kickoff analysis at the AI Cybersecurity and Resilience Summit during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed turning AI policy into enforceable controls, starting with data hygiene. (* Disclosure below.)
Data discovery and classification as AI’s first line of defense
A central concern for chief information security officers is controlling AI inside their own organizations. But none of it is entirely new since organizations have long used role-based access control and least privilege to protect regulated data, Oltsik noted.
“Now we have to adjust it to a very dynamic, non-deterministic world of AI, and we have to do that at a pace that keeps up with the scale and speed of AI,” Oltsik said. “None of that is easy.”
How much autonomy to grant agents depends on each organization’s risk tolerance.
The European Commission has issued draft guidance on classifying high-risk AI systems under the EU AI Act, according to Oltsik. Agents that touch sensitive data or act autonomously still warrant human oversight, much as early intrusion prevention tools once did.
“What we have to do is ease into those decisions, understand what actions agents or models are taking and then, over time, develop a comfort level,” he said.
Enterprises should get the basics right, starting with data discovery and classification, identity and access management and audits of overly permissive accounts, including those held by agents, Oltsik noted. Security leaders also need to participate in decisions about how the business adopts AI.
“The security team can’t be the division of ‘no,’ or the [chief information security officer] cannot be Dr. No,” he said. “How do you do that? How do you make sure that you go into AI with business objectives and business goals, but the right type of risk management and risk mitigation?”
Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the AI Cybersecurity and Resilience Summit:
(* Disclosure: TheCUBE is a paid media partner for the AI Cybersecurity and Resilience Summit 2026 event. Sponsors of theCUBE’s event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)