The other day, someone said, “AI security is fundamentally data security”. And this got me thinking. Is it? Can AI security simply be solved with a typical data security strategy?

It’s one of those statements that sounds correct when you first hear it, and it gets a few nods in the room, but then it quietly does a lot of damage to how people think about the problem.

So, let’s dive into it, because the statement is really quite misleading. Not because data security is unimportant to AI (on the contrary) but because reducing “AI security” to “data security” completely misses everything that makes it its own challenge. And once you do that, people apply the wrong controls in the wrong places.

The argument of “X is fundamentally Y” almost always smuggles a vast oversimplification that you can usually keep leveraging until you reach something absurd:

This is a joke (obviously). But it's a useful one because it shows how "fundamentally" collapses a discipline into a subset of another by ignoring the properties that emerge at higher layers. Each layer adds problems that did not exist at the layer below, and those problems are the entire reason the discipline exists.

That said, the framing of data security is still relevant. Protecting confidentiality, integrity, and availability of data at rest, in transit, and in use. Encryption, access control, classification, DLP, key management, masking, and redaction. It is a mature and familiar field with clear objectives.

However, the reason people make this reduction is understandable, as a huge amount of corporate data now flows into AI tools. And in that sense, the statement can be seen as fitting when considering the scale of the data problem, while still being wrong in concluding that existing data security playbooks will adequately address it.

AI security is built on data security, but it can’t be reduced to it. The systems performing the reasoning introduce their own behaviours, failure modes, and attack surface that data hygiene alone cannot address.

So, if AI security isn't just data security, where does it diverge? In two directions!

…Though most people only talk about one.

The first is everything people raise at AI security events: prompt injection, runaway agents, model judgement failures, model poisoning, and supply chain attacks.

These are legitimate new problems that need addressing. The FCA, Bank of England, and HM Treasury's May 2026 

 on frontier AI models and cyber resilience focused almost entirely on AI attacker capabilities, including how they are accelerating vulnerability discovery and raising the bar for organisational resilience.

The second direction is AI exposure risk, and this is the main threat organisations are being hit with every single working day.

The sheer amount of data employees are now voluntarily submitting to thousands of AI solutions, which typical security tools have no awareness of, is staggering.

 found 75% of knowledge workers using AI at work, 78% bringing their own tools, and 52% reluctant to admit using AI for their most important tasks. Meanwhile, 

 found that around 55% of content submitted to public AI tools is sensitive. Together, these stats paint a picture of a continuous, voluntary, high-bandwidth stream of corporate context flowing into models that organisations neither own nor audit.

The instinctive reaction is, "OK fine. That's data leaving the building. That's what DLP is for." And this is where the data security framing breaks down the most.

Traditional DLP is built around pattern matching. It looks for things like credit card numbers, structured PII, source code, and document classification labels. AI-related risks rarely fit those patterns.

The real challenge with AI comes from seemingly ordinary interactions: "Summarise this strategy document", "Rewrite this customer complaint", "Debug this production issue", or "Draft a response to this regulator". None of these prompts contain typical indicators that a traditional DLP system would reliably detect.

The actual risk emerges from the context of otherwise normal-looking work behaviour: who is making the request, what information they are working with, which AI tool they are using, and what that tool will do with the information afterwards. These are behavioural and contextual signals, not pattern-matching problems.

As a result, simply blocking activity is often ineffective. Users will (almost certainly) work around restrictions by switching to personal accounts or unmanaged tools, moving the activity entirely beyond the visibility of corporate controls, which is a much worse scenario.

This is why the challenge of AI security is not simply a data flow problem. It introduces a new category of risk, one that is contextual, behavioural, and considerably more complex than conventional data security technologies were designed to handle.

And even if you set all of that aside, the first set of risks are still sitting there, compounding the problem:

So, there are two core directions of divergence that traditional data security cannot address: data-related risks it cannot understand properly, and broader AI risks where data is not the thing going wrong at all.

If you believe AI security is fundamentally a data security issue, you will buy DLP for prompts and write policies about data classification while employees continue using AI tools you've never inventoried, and agents gain permissions you've never evaluated.

The framing also shapes ownership. If viewed as a data security problem, AI security sits with data protection teams. Viewed as its own discipline, it draws on behavioural visibility, identity, application security, observability, and real-time control.

So, if AI security is not fundamentally data security, what is it?

At its core, AI security is a behavioural problem operating across two distinct layers that need to be enabled securely whilst preventing harm.

 is concerned with how people use AI. Which tools are being used, what access they have to corporate systems, what information is being shared, and whether usage aligns with organisational policy and risk appetite.

Here, blocking alone typically fails, and effective human-layer AI security requires visibility, governance, education, and context-aware controls that enable safe use in real-time.

 is concerned with what AI systems themselves do. Models can misjudge situations, hallucinate, follow malicious instructions, and take unintended and catastrophic actions. As agents gain access to tools and workflows, organisations need reliable controls that govern Agent behaviour in real-time, including permission boundaries, observability, testing, and containment.

Data security supports both these layers but governs neither. The challenge is no longer simply protecting information; it is understanding behaviour, controlling actions, and enabling (and encouraging) the safe adoption and use of AI technologies.

So, is AI security fundamentally data security? No.

Data security is an important foundation, but foundations are not the same as the structures built on top of them. The moment we introduced systems that reason, make decisions, take actions, and influence human behaviour, we created an entirely new set of security challenges that data controls alone cannot address.

If we treat AI security as a data security problem, we’ll invest in tools designed to inspect content while missing the behaviours that create real risk. We'll measure the wrong things, assign ownership to the wrong teams, and wonder why shadow AI continues to grow while agents quietly increase their authority.

We’re no longer simply challenged with protecting information. We now need to understand how people use AI, how AI systems behave, and how both can be governed safely at scale.

So next time you hear someone say something like, "AI security is fundamentally data security," examine it closely. You’ll realise that the word "fundamentally" is doing a lot of work in that sentence...

So, let’s dive into the statement “AI security is fundamentally data security”, as it really is quite misleading. Not because data security is unimportant to AI (on the contrary) but because reducing “AI security” to “data security” completely misses everything that makes it its own challenge. And once you do that, people apply the wrong controls in the wrong places.

Why AI Security Is Not Data Security

Recommended for you

But Control Over Data and IP Is Still Catching Up

Securing AI in the Enterprise: Facilitating Innovation whilst Securing Adoption

The Offensive Potential of Computer-Using Agents