Our view
Access was never the finish line.
3 min read
At CloudKnox, we built a company around a simple observation: in cloud infrastructure, the gap between the permissions identities held and the permissions they actually used was enormous. People and machines carried thousands of entitlements and exercised a handful. The industry eventually gave the problem a name — cloud infrastructure entitlement management — and by the time Microsoft acquired us, closing that gap had become a standard security discipline.
The question we answered was: who can access what, and is that grant justified?
But through all of those years, a harder question kept surfacing, and it sat outside the charter of every access product I had ever seen: what happens after access is granted?
Every access decision ends at the moment of the grant. The user is authenticated, the device is compliant, the entitlement checks out — the file opens. At that instant, the security stack’s work is done. The data’s journey has just begun. It gets copied, moved, shared, summarized, transformed, and persisted, and the decision that authorized the first open governs none of what follows.
For decades, this was a tolerable gap. Data moved at human speed, through a small set of sanctioned applications, between people who mostly worked inside the same boundary. The volume of movement was low enough that boundary controls, plus good judgment, kept exposure acceptable.
Then the velocity changed.
AI changed two variables at once: how fast data moves, and how many places it moves to. A single authorized use now fans out: an upload to an assistant, a slice of an agent’s context window, an AI-generated summary that inherits the sensitivity of its source but none of its protection — and no lineage back to what fed it. Agents act at machine speed, around the clock, through paths that no perimeter control was designed to observe.
AI didn’t create the control gap. It multiplied it.
Security leaders already see this in their own environments. In a 2025 Gartner survey, 69% of cybersecurity leaders reported evidence — or strong suspicion — that employees are using prohibited public generative AI tools. IBM’s 2025 breach research found that one in five breaches now involves shadow AI, adding roughly $670,000 to the average cost of a breach. These aren’t projections. They’re measurements.
The stack didn’t fail. The perimeter moved.
It’s tempting to read this as an indictment of existing controls. It isn’t. Boundary and detection tools do exactly what they were designed to do — the difficulty is that the boundary they defend is no longer where the data lives. Data crosses the perimeter legitimately, thousands of times a day, because crossing it is the business. And the moment it crosses, protection stays behind.
The other pressure point is classification. Most data-protection regimes ask every employee to participate as a policy engine: label this, justify that, file an exception. That doesn’t scale — not because people don’t care, but because the workflow fights them. The result is the state most security teams quietly live in: false-positive queues, exception backlogs, and users routing around controls because the controls are in the way.
The architecture puts control at the boundary. The data lives everywhere else. No amount of tuning closes a gap that structural.
What the next layer has to do.
If the boundary can’t hold the control, the data has to carry it. Concretely, that means four things. Protection must attach to the data itself, so it persists wherever the data travels. Every use must be verified — not just the first open. People and machine agents must pass through the same gate, evaluated by the same policy. And enforcement must be continuous, because context changes after access is granted: devices drift out of compliance, employees leave, agents get repurposed.
Just as important: this layer has to compound the investments enterprises have already made, not compete with them. Identity from your IdP, posture from device management, sensitivity labels from your classification and DSPM programs — those signals are valuable precisely because they can extend protection beyond the boundary, instead of stopping at it.
That’s the question I couldn’t put down after CloudKnox: not who may open the file, but what governs it afterward — for a workforce that now includes software.
This is what we’re building at Tika, with a small group of design partners. If this gap is on your risk register, we’d like to compare notes.
Talk to us