When Security Becomes Invisible

The word “silo” carries a familiar meaning in data conversations: information trapped in one place, cut off from the rest of the organization. So when I asked Scott Davis whether data security itself had become a silo, his answer took us somewhere different. “My knee-jerk reaction was absolutely, it’s a silo,” he told me. Then he reconsidered. “When you think of silos, we think of data being stuck in its own little corner. And that’s not the case with data security at all.”

What Scott was describing was not data that cannot move. It was data that moves quite freely, often farther than an organization’s ability to account for its protection. Sensitive data is identified, controls are applied, PII is tokenized and access rules are established. At the source, the security posture may be clear. But the data does not stay there. It moves through processing, analytics and models, and increasingly into AI agents. The farther it travels from where those controls were applied, the harder it can become to say with confidence that they are still intact.

“It’s almost like the telephone game,” Scott said. “Data security, your CISO, if you ask them on the very left side, they say it’s 100%. Now let’s move through. Data moved from here to here to here to here. Is it secure there?” Then he made the distinction that sits at the center of his argument: “The data might still be secure. But if it’s not observable at that far side at the AI layer, then it’s not secure, even if it is actually secure.”

Security may still exist. What has been lost is certainty.

IBM’s 2025 Cost of a Data Breach Report found that among organizations reporting a security incident involving their AI models or applications, 97 percent lacked proper AI access controls, evidence that AI access is moving faster than the controls around it.

Scott makes the problem more concrete through three familiar layers: identifying personally identifiable information, tokenizing sensitive values and enforcing access controls. The weakness appears when an organization assumes that because those protections existed at the beginning of the data journey, they must still be working together at the end. In implementations where tokenization can be reversed, for example, protecting the mechanism that allows the original information to be recovered matters just as much as tokenizing the data in the first place. “Is there a scenario where that key is available to a data scientist and they can just reverse it? The answer is yes, absolutely.”

Access controls can fail for another reason. They depend on people and systems continuing to honor the governance around them, and when those processes become too cumbersome or too slow, workarounds appear. “You’ve sidestepped that access control, and you now have an open window for accessing sensitive data if you can get the key and reverse that tokenization.” For Scott, the point is that the protections have to remain present and observable together at the point where AI reaches the data. “You now have three layers of protection that are observable when AI is going to access data.”

When both sides win, the company can still lose

We came back to observability when I asked about one of the most familiar tensions inside enterprise AI. The business wants to move quickly. Security needs enough evidence to understand the exposure. The usual assumption is that one side eventually has to give. Scott rejected that premise. “I don’t think there’s somebody that wins by default,” he said. “I think the real problem is when both win.”

His example is a business unit that identifies a twenty-million-dollar problem and creates enough organizational pressure to get an AI initiative deployed without an adequate security review. The initiative begins producing value, but the exposure has increased along with it. Eventually the CISO finds the problem and shuts it down. “Then they’re going to kill it,” Scott said. “So now you invested all of that time and energy and money, potentially with downsides, potentially with upsides, and then it gets shut down. This demoralizes the team that built it. This sets you back because now you’re back to the drawing board redoing something that was already done.”

The business was right to pursue the opportunity. Security was right to intervene. The organization still loses.

Cisco’s 2025 Data Privacy Benchmark Study shows some of that tension already in play. Sixty-four percent of the security and privacy professionals surveyed were concerned about information entered into GenAI being shared publicly or with competitors, while nearly half reported personal employee or non-public information being entered into the tools. The data is already moving while organizations are still working through what appropriate use looks like.

Scott’s answer is not to force one side to move at the pace of the other. It is to make the security state visible enough that both sides can make a decision from evidence rather than assumption. “The observability of security end to end is essentially the fix to that conundrum,” he said. If a team can show what protections are operating and where, the review becomes less dependent on reconstructing the environment after the fact. “Say you can move fast, and you say it’s safe, it’s secure, and you can show it. Well, that pace is now allowed.”

There is a human constraint here too. When I suggested that pace is underestimated, that there is a limit to how fast people can grow comfortable with something potentially risky, Scott agreed. The people responsible for security are being asked to make consequential decisions about increasingly complex systems at a speed those systems were not historically reviewed at. Visibility does not remove that judgment. It gives the person making it something better to work with.

In Scott’s framing, good governance should largely disappear into the way the organization works. Security should not. “Governance makes things function well. Security is this authoritative layer that says we have to be there and you have to know that we’ve been there.” He sees the growing overlap between the two as useful rather than problematic. “The connectivity between security and governance across the board has blurred the lines for which is actually which,” he said, “and that’s a really good thing.”

Our conversation turned to airlines, where passenger records, payment information and operational data create an already complicated environment. Scott resisted making the industry sound exceptional. “Airlines aren’t that different from other organizations that have a lot of sensitive data and a lot of complexity. But yes, airlines fall into the ‘it’s complicated’ category.”

The problem he sees most often is not too little security, but accumulated security. One safeguard leads to another. Access is restricted, environments are separated, then cloud environments are separated. Each decision can make sense on its own, but together they create a system that becomes increasingly difficult to work within. “You can use a lot of the access controls we’ve talked about to separate and limit access to data,” he said. “But what if you make a mistake? So let’s add some separation and require a different environment. That’s more secure. What’s more secure than that? Completely separate clouds, this data on Azure, that data on AWS.”

Eventually, the complexity creates the workaround. Scott compares it to forcing people to change passwords so frequently that someone writes the current one on a sticky note and leaves it on the desk. The control still exists, but the behavior it produces has weakened the protection it was intended to create.

That problem becomes more consequential when AI agents begin accessing systems directly. It was also a question we brought to Scott from our own coverage: as agents start to query airline systems through emerging protocols like the Model Context Protocol (MCP), the line between authentication, which establishes that an agent is legitimate, and authorization, which determines what it is actually allowed to see or do, matters more. Scott pushed authorization one step further, to what the person receiving the agent’s output should be allowed to see. “Authorization is not an agent problem, it’s a people problem.” Rather than sending a static report that anyone with the file can open, his example is an interface that authenticates each person and determines what that individual is permitted to see.

The agent itself also needs appropriately limited permissions in the systems it reaches. OWASP’s guidance on excessive agency recommends giving AI systems only the functions and permissions required for the task and enforcing authorization in downstream systems. Controlling what eventually appears to a person cannot substitute for controlling what the agent was able to retrieve in the first place.

The green base and the red blocks

By this point, I wanted a way to see what Scott was describing. Late in our conversation, I asked him to explain the difference between governance and security using a box of LEGOs.

“You know that giant green LEGO base?” he said. “That’s your governance layer. Everything fits on top of that green layer. Imagine trying to build any little LEGO city you wanted on carpet. It’s just going to fall over. That green base is the functional foundation that is key for everything to live on.”

Security, in his analogy, is the red blocks. “It’s the very first block that lives on the left side that you place. And as you build, as you move along from left to right along this big green platform, there is a red block in every single one of those verticals.” Good security means those red blocks remain visible across the platform, from where the data enters the environment to where AI is using it.

Then Scott described what he sees happening instead. Organizations, he said, tend to fall into two camps. Some may have only one red block left at the far right. More often, he suspects, someone has put a cover over the right side, so when you ask where your red blocks are, nobody can tell you; they’re covered up. And the CISO still calls it secure, because there were three red blocks on the left side when the building started.

For me, that was where the silo problem became easier to see. Once the green base itself is cut into separate systems and environments, each with its own conventions and controls, the organization begins losing a common view of the protections across them. By the time AI reaches the far side, the red blocks may still be there. What is missing is the ability to see them and prove it.

Scott believes that gap is about to become harder for organizations to ignore. What governance was to 2025 and into 2026, he thinks security will become in 2027: something organizations already know matters, but have not yet fully accounted for in the way AI changes where data goes and what interacts with it. “The AI threat is going to show itself enough times across enough organizations that it’s the area where organizations are going to stop, pause, make sure they figure out how to solve it, and then do it right before they continue.”

Scott’s timing is his own prediction, but the broader direction is showing up elsewhere. In an April 2026 forecast, Gartner projected that by 2028, 25 percent of enterprise GenAI applications will experience at least five minor security incidents annually, up from 9 percent in 2025. Gartner tied the increase to expanding agentic applications, new attack vectors and immature security practices. The timing is different, but the direction of travel aligns with the problem Scott is describing.

“We’re at the tip of this becoming a really important big deal,” Scott said. “But not enough organizations have solved it or really started to break down the problem to solve.”

The LEGO analogy is the one I keep coming back to. The red blocks may still be there. Knowing they were there when the data started its journey is no longer enough. The question is whether you can still see them at the other end.