AI data protection: what models can’t unlearn
Deleting a record takes a second. Getting that record back out of a trained model takes considerably longer.
The riskiest thing in your environment this quarter probably isn’t a model. It’s a folder named “Finance – Shared” that half the company has been able to open since 2019, plus a new AI assistant that can read it, summarize it, and cite it on request.
AI didn’t create a new exposure. It just hired the most thorough reader your organization has ever had and handed it the permissions everyone else already has.
Security through obscurity no longer works
Over-permissioned data has always been a known problem and a quiet one. Files were technically reachable and practically undiscoverable, because nobody browses 40 terabytes of shared drives hoping to find a severance agreement. The risk sat there for years, unexploited, somewhere below the line on every access review.
AI assistants come along as data retrieval tools. An assistant reads everything it can reach and answers in plain language based on what’s been found. A person was unlikely to stumble across that folder, and might have thought twice before opening it. An assistant does neither. Nothing about the permissions changed, but security through obscurity fails spectacularly in the age of AI.
Most exposure isn’t in the training set
There’s a common assumption that AI data protection is mainly about training data. For organizations building their own models, it is. For everyone else, it’s about protecting the sensitive data you already have before an AI tool reaches it. Retrieval-augmented generation (RAG) accounted for 51 percent of production AI deployments. Fine-tuning accounting for just 9% in the same Menlo Ventures’ 2024 survey, and its 2025 edition reports fine-tuning is still niche, used mainly by frontier teams.
Using data for RAG is fundamentally different than using data to fine tune or build a model. Training data requires a subset of data that is selected and, hopefully, monitored by an internal team adding human judgment into the process. On the other hand, RAG processes often point an AI assistant at a repository and tell it “this is the truth” Asking which repositories this tool can reach, what is actually in them, and who was supposed to have access in the first place is a required step to protecting the organization.
For data security teams, securing data for retrieval is the part that’s ongoing, unglamorous, and squarely inside your control.
Your access model has a new class of user
AI tools, agents, and the service accounts behind them read data all day. They authenticate, they inherit permissions, and they often hold broader access than any individual employee, because someone provisioned them generously during a pilot and nobody revisited it afterward.
Among organizations that reported an AI-related security incident, 97 percent said they lacked proper AI access controls, according to IBM’s Cost of a Data Breach 2025. That concern has less to do with rogue agents than with entitlements nobody reviewed.
What closes the gap
There’s no shortage of things you could do here. Start with four.
- Find out what the repositories actually hold. Classification before connection. “It’s just the marketing drive” is a hypothesis, not an inventory.
- Review entitlements on those repositories first. Scope the access review to what is already connected or queued for connection, instead of attempting the whole estate at once.
- Reduce what’s there. Redundant and obsolete data can’t be retrieved if it was defensibly deleted last quarter.
- Protect the sensitive values that remain. Masking, format-preserving encryption, and tokenization keep data usable for the business while the values themselves stay protected in transit, at rest, and in an answer.
Finding the exposure is the first step, it is not the fix. A report listing 4,000 over-permissioned files is useful once. What changes your posture is the remediation behind it, which means correcting the access, minimizing the data, and protecting the values that stay.
Bring these to your next AI review
Your organizations AI assistants will read whatever you let it read, and they won’t stop to wonder whether they should. That decision was made months ago, in a permissions change nobody documented. The good news is that it’s still reversible.
