Why AI Security Is Not Data Security

How the Wrong Framing Creates New Risk

Introduction

The other day, someone said, “AI security is fundamentally data security”. And this got me thinking. Is it? Can AI security simply be solved with a typical data security strategy?

It’s one of those statements that sounds correct when you first hear it, and it gets a few nods in the room, but then it quietly does a lot of damage to how people think about the problem.

So, let’s dive into it, because the statement is really quite misleading. Not because data security is unimportant to AI (on the contrary) but because reducing “AI security” to “data security” completely misses everything that makes it its own challenge. And once you do that, people apply the wrong controls in the wrong places.

…and that’s how you get breaches.

The Data Security Reductionism Problem

The argument of “X is fundamentally Y” almost always smuggles a vast oversimplification that you can usually keep leveraging until you reach something absurd:

• AI security is fundamentally data security.
• Data security is fundamentally computer security.
• Computer security is fundamentally computer science.
• Computer science is fundamentally maths.
• Therefore, the security budget should go to the maths department.

This is a joke (obviously). But it's a useful one because it shows how "fundamentally" collapses a discipline into a subset of another by ignoring the properties that emerge at higher layers. Each layer adds problems that did not exist at the layer below, and those problems are the entire reason the discipline exists.

That said, the framing of data security is still relevant. Protecting confidentiality, integrity, and availability of data at rest, in transit, and in use. Encryption, access control, classification, DLP, key management, masking, and redaction. It is a mature and familiar field with clear objectives.

However, the reason people make this reduction is understandable, as a huge amount of corporate data now flows into AI tools. And in that sense, the statement can be seen as fitting when considering the scale of the data problem, while still being wrong in concluding that existing data security playbooks will adequately address it.

AI security is built on data security, but it can’t be reduced to it. The systems performing the reasoning introduce their own behaviours, failure modes, and attack surface that data hygiene alone cannot address.

Where AI Security Diverges

So, if AI security isn't just data security, where does it diverge? In two directions!

…Though most people only talk about one.

Attacker Capabilities

The first is everything people raise at AI security events: prompt injection, runaway agents, model judgement failures, model poisoning, and supply chain attacks.

These are legitimate new problems that need addressing. The FCA, Bank of England, and HM Treasury's May 2026 joint statement on frontier AI models and cyber resilience focused almost entirely on AI attacker capabilities, including how they are accelerating vulnerability discovery and raising the bar for organisational resilience.

These threats from AI get the headlines.

AI Exposure

The second direction is AI exposure risk, and this is the main threat organisations are being hit with every single working day.

The sheer amount of data employees are now voluntarily submitting to thousands of AI solutions, which typical security tools have no awareness of, is staggering.

Microsoft's 2024 Work Trend Index found 75% of knowledge workers using AI at work, 78% bringing their own tools, and 52% reluctant to admit using AI for their most important tasks. Meanwhile, Menlo Security found that around 55% of content submitted to public AI tools is sensitive. Together, these stats paint a picture of a continuous, voluntary, high-bandwidth stream of corporate context flowing into models that organisations neither own nor audit.

The Instinctive Reaction

The instinctive reaction is, "OK fine. That's data leaving the building. That's what DLP is for." And this is where the data security framing breaks down the most.

Traditional DLP is built around pattern matching. It looks for things like credit card numbers, structured PII, source code, and document classification labels. AI-related risks rarely fit those patterns.

The real challenge with AI comes from seemingly ordinary interactions: "Summarise this strategy document", "Rewrite this customer complaint", "Debug this production issue", or "Draft a response to this regulator". None of these prompts contain typical indicators that a traditional DLP system would reliably detect.

The actual risk emerges from the context of otherwise normal-looking work behaviour: who is making the request, what information they are working with, which AI tool they are using, and what that tool will do with the information afterwards. These are behavioural and contextual signals, not pattern-matching problems.

As a result, simply blocking activity is often ineffective. Users will (almost certainly) work around restrictions by switching to personal accounts or unmanaged tools, moving the activity entirely beyond the visibility of corporate controls, which is a much worse scenario.

This is why the challenge of AI security is not simply a data flow problem. It introduces a new category of risk, one that is contextual, behavioural, and considerably more complex than conventional data security technologies were designed to handle.

And even if you set all of that aside, the first set of risks are still sitting there, compounding the problem:

• Prompt injection isn't a data problem: the data is fine; it's the model's inability to distinguish instructions from content that’s the problem.
• Agentic action isn't a data problem: They can operate alone and have you wake up a merged malicious pull request because an upstream issue comment told it to.
• Model judgement isn't either. For example, 1Password tested eight models across 30 scenarios and found that every one committed a critical failure in every run.
• Neither is shadow AI. The risk comes from AI usage moving beyond organisational visibility and control, not from the data itself.

So, there are two core directions of divergence that traditional data security cannot address: data-related risks it cannot understand properly, and broader AI risks where data is not the thing going wrong at all.

What AI Security Actually Looks Like

Security controls follow framing.

If you believe AI security is fundamentally a data security issue, you will buy DLP for prompts and write policies about data classification while employees continue using AI tools you've never inventoried, and agents gain permissions you've never evaluated.

The framing also shapes ownership. If viewed as a data security problem, AI security sits with data protection teams. Viewed as its own discipline, it draws on behavioural visibility, identity, application security, observability, and real-time control.

So, if AI security is not fundamentally data security, what is it?

At its core, AI security is a behavioural problem operating across two distinct layers that need to be enabled securely whilst preventing harm.

The human layer is concerned with how people use AI. Which tools are being used, what access they have to corporate systems, what information is being shared, and whether usage aligns with organisational policy and risk appetite.

Here, blocking alone typically fails, and effective human-layer AI security requires visibility, governance, education, and context-aware controls that enable safe use in real-time.

The machine layer is concerned with what AI systems themselves do. Models can misjudge situations, hallucinate, follow malicious instructions, and take unintended and catastrophic actions. As agents gain access to tools and workflows, organisations need reliable controls that govern Agent behaviour in real-time, including permission boundaries, observability, testing, and containment.

Data security supports both these layers but governs neither. The challenge is no longer simply protecting information; it is understanding behaviour, controlling actions, and enabling (and encouraging) the safe adoption and use of AI technologies.

Conclusion

So, is AI security fundamentally data security? No.

Data security is an important foundation, but foundations are not the same as the structures built on top of them. The moment we introduced systems that reason, make decisions, take actions, and influence human behaviour, we created an entirely new set of security challenges that data controls alone cannot address.

If we treat AI security as a data security problem, we’ll invest in tools designed to inspect content while missing the behaviours that create real risk. We'll measure the wrong things, assign ownership to the wrong teams, and wonder why shadow AI continues to grow while agents quietly increase their authority.

We’re no longer simply challenged with protecting information. We now need to understand how people use AI, how AI systems behave, and how both can be governed safely at scale.

So next time you hear someone say something like, "AI security is fundamentally data security," examine it closely. You’ll realise that the word "fundamentally" is doing a lot of work in that sentence...

...Most of it, bad.