Cybersecurity briefing
/
AI Is Making Old Data Permissions a New Business Risk
Cyera's research shows an AI assistant surfacing sensitive data within existing permissions. Why access cleanup must come before AI rollout.
/
AUTHOR
Jeff Dyer
/
SHARE THIS ARTICLE
Overview
An employee can have permission to read a document without knowing it exists. An AI assistant can close that gap in seconds. Research published by Cyera on October 14 describes how an always-on assistant surfaced sensitive information within its owner's existing access, illustrating a problem that predates AI but becomes more consequential when software does the searching.
The researchers' account is a vendor-conducted test, not evidence of a customer breach or a universal failure across AI products. Its central observation deserves a place in enterprise deployment decisions: respecting an existing permission does not establish that the permission was appropriate.
Search friction was never an access control
Shared repositories accumulate exceptions. A project folder remains available after the project closes. A spreadsheet inherits access from its parent directory. A team gains membership in a broad group because someone needed a document quickly. Over time, the permissions describe the history of collaboration more accurately than the current need to know.
Those mistakes can remain inconspicuous because employees rarely explore everything they can reach. An unfamiliar folder name, an old site or thousands of irrelevant files can make sensitive material difficult to find. That obscurity offers little protection once an assistant can search, summarize and connect information across repositories.
Consider a hypothetical procurement analyst preparing a supplier review. The analyst needs commercial terms and service history. An inherited permission also exposes a planning spreadsheet containing an acquisition target. The assistant may retrieve both because each appears relevant to the supplier's future. Every read can be authorized by the repository while the combined answer discloses information outside the analyst's assignment.
The failure occurs before an external transfer. Information has already reached an internal audience that should not have received it. Controls focused only on outbound email or uploads address a later stage of the problem.
The review has to start with the data
Approving an AI application answers only part of the deployment question. Security teams also need to establish which repositories it can reach, what those repositories contain and how access is inherited. A connector approved for a narrow business purpose can still inherit the connected account's much broader reach.
Data security posture management, or DSPM, platforms help assemble that view by discovering sensitive information and relating its sensitivity to exposure and permissions. Cyera's DSPM platform combines discovery and classification with identity and access context across supported data sources. It can help teams identify sensitive material exposed through broad sharing and route corrective work to the people responsible for it.
The corrective work starts at the repository, before an assistant searches it. Discovery and classification provide evidence for that work; owners still have to decide who needs access. Coverage and available remediation actions depend on the data source and integration in use, and an assessment of stored data does not establish that every AI interaction is controlled.
Classification also needs business meaning. A document may contain no account numbers, health records or obvious secrets and still describe a confidential transaction. Reviews that consider only familiar regulated-data patterns can miss information whose sensitivity comes from its purpose, audience or timing.
Correct the permission without breaking the workflow
Finding broad access is easier than deciding what should replace it. A finance folder may support several legitimate processes. Removing an entire department can interrupt reporting, while leaving the folder unchanged preserves the exposure. The useful unit of review is the business task and the information needed to perform it.
Repository owners should determine which groups require access, whether an inherited grant is still justified and whether sensitive material belongs in a separately controlled location. Security supplies the exposure evidence; the business owner establishes the legitimate audience. Exceptions need an owner and a review date so temporary collaboration does not become permanent entitlement.
A pilot can make that review concrete. Give an assistant a small set of representative tasks using test accounts with realistic group memberships. Check which sources it retrieves, whether unrelated sensitive material appears and where the resulting summaries are stored. Correct the source permissions and repeat the test. A successful settings change is weaker evidence than a confirmed change in what the account can retrieve.
Retrieval and sharing need separate decisions
Even an appropriate read does not authorize every subsequent use. An assistant may need to consult a confidential contract to answer its owner while remaining prohibited from quoting it in a shared channel. Source access, answer visibility and the destination of a generated file deserve separate checks.
This also creates a lifecycle question for derived material. A summary, export or copied excerpt can persist after the original permission changes. Deployment plans should identify those outputs, apply suitable retention and access controls, and test what revoking a connector actually removes. Revocation should not be assumed to erase every copy created earlier.
Organizations can begin with one valuable workflow and its connected repositories. Identify the sensitive information, remove unnecessary access, test retrieval under real user roles and verify where outputs land. Expanding an assistant's reach should follow that evidence. AI does not need to defeat a permission system to expose its accumulated mistakes; it can simply become much better at using it.
