AI growth challenges data security in major enterprises

The "2025 Enterprise Data Security Confidence Index" survey highlights significant challenges in data visibility and security as AI adoption increases within enterprises.

The report surveyed 530 cybersecurity professionals from organisations with more than 1,000 employees. Findings indicate that 82% of security teams have reported difficulties in identifying and classifying sensitive data. Furthermore, 53% of these teams lack real-time visibility, taking days or weeks to locate sensitive data assets.

Bruno Kurtic, CEO and co-founder of Bedrock Security, commented on the complexity introduced by the generation, copying, and storage of data across various environments, such as IaaS, PaaS, and SaaS. "Organisations now generate, copy and store data across multiple environments — including IaaS, PaaS and SaaS — creating numerous blind spots," he said. "This survey shows this problem is widespread and likely getting worse."

The gap in data asset inventory also presents issues. A total of 76% of organisations admitted they cannot quickly provide a complete data asset inventory, an essential requirement for compliance or security incidents.

Additional findings show that 63% of security teams claim they can identify who accessed specific sensitive data within the last 30 days within 24 hours, leaving a considerable proportion without timely visibility.

The evolving role of security professionals has become evident, with 86% stating their responsibilities have altered over the past year. This shift largely pertains to data governance and AI oversight, as organisations increasingly focus on these areas.

Regarding AI security, the survey reveals only 48% of organisations have high confidence in controlling sensitive data tied to AI and machine learning (ML) training. Kurtic notes the existing challenges, "When we ask security teams how quickly they can identify the most foundational information about their data, such as who accessed specific sensitive data in the last 30 days, the numbers are equally concerning," he added.

Gabe Stapleton, Vice President, Security, and Enterprise Technology, and CISO at Strive Health, shared his positive experience with Bedrock's technology. "The fact that Bedrock can accurately and quickly surface relevant events and security concerns is the biggest win for Strive Health," he said, citing the benefits of Bedrock's Metadata Lake and Copilot technology in maintaining a secure and well-governed environment.

Bedrock Security has introduced a new metadata lake to address these issues, providing continuous visibility by cataloguing what data exists, where it resides, who can access it, and its sensitivity. Todd Thiemann from Enterprise Strategy Group remarked on the relevance of this development, "By shifting from infrastructure protection to data-aware security, organisations can better prioritise risks and remediate based on actual sensitivity and leverage information while maintaining appropriate safeguards."

Bedrock Security's new offerings include the Bedrock Metadata Lake Copilot to streamline interactions with the metadata lake, AI Agents for DSPM to automate security workflows, and Bedrock Free for Snowflake to discover and classify sensitive data. Kurtic described Bedrock's role in helping organisations manage data issues, "Data growth, cloud modernisation and AI adoption are making it difficult to see, manage and secure information across distributed environments."

"Security teams just can't keep up with the complexity created by the speed and volume of data generation," Kurtic noted further, underscoring the automation and visibility challenges faced by these teams.

Chirag Mehta from Constellation Research elaborated on the obstacles related to AI adoption, "Organisations often struggle with AI adoption because they lack clear visibility into their data, directly hindering their ability to achieve meaningful business outcomes." He further added that addressing this disconnect would help enhance security postures and overcome AI implementation barriers.