A data-centric security model for the AI, cloud and insider-risk era
October 19, 2026
Amit Mishra
Global Head of Data and AI Practice, Cybersecurity, HCLTech
October 19, 2026
Executive summary
Zero Trust has helped enterprises strengthen identity and access controls, but the next security challenge begins after access is granted. Sensitive data now moves across SaaS, cloud, endpoints, collaboration platforms and AI systems. A verified identity does not automatically mean safe data usage. The next evolution is Data-Centric Zero Trust: continuously discovering, classifying, governing, protecting and monitoring data based on context, exposure and behavior.
The evolution from perimeter to identity to data
Zero Trust has become one of the defining principles of modern cybersecurity. It has traditionally focused on identity and access management through the principle: “Never trust, always verify.” Enterprises have invested in identity verification, multi-factor authentication, privileged access controls and access governance.
However, a critical question remains: what happens after access is granted? A user may be authenticated, an application may be approved and a session may be valid, yet sensitive data can still be copied, downloaded, shared, uploaded to AI tools or exposed through excessive permissions.
The next evolution of Zero Trust is therefore clear: security must extend beyond identity and follow the data itself.
The limitation of identity-centric Zero Trust
Identity-centric Zero Trust reduces unauthorized access, but it does not fully control authorized misuse, accidental exposure or risky data movement. Traditional controls focus on whether a user should access a system; data-centric controls ask whether the user should access this specific data, in this context, for this purpose, at this time.
Why data needs its own Zero Trust model
- Data is highly distributed: Enterprise data resides across multi-cloud environments, SaaS platforms, endpoints, collaboration tools, databases, data lakes and AI systems. There is no single perimeter where data can be fully contained.
- Identity does not equal trust: Legitimate users can accidentally share sensitive information, misuse excessive privileges or move data into uncontrolled locations. Verification of identity must be complemented by verification of data usage.
- AI has changed data movement: GenAI, copilots and automation can consume, transform and generate sensitive information. Data may enter prompts, model workflows, third-party services or AI-generated outputs, creating exposure paths that identity controls alone cannot govern.
- Exposure defines risk: Risk is no longer based only on whether data is sensitive. It is based on sensitive data plus exposure: who can access it, where it has moved, whether it is over-permissioned and whether its usage pattern is appropriate.
Five pillars of Zero Trust for data
Core capabilities required
Identity-centric vs data-centric Zero Trust
Real-world scenario: Financial services and AI usage
Consider a financial analyst with legitimate access to confidential revenue and customer data. In a traditional Zero Trust model, the analyst is authenticated and granted access to the financial system. But if the analyst exports a large dataset, uploads it to an external AI tool or shares it with a broader audience, the data risk increases even though the identity decision was correct.
Data-centric response
A data-centric Zero Trust model evaluates the type of data, access volume, user behavior, destination, sharing pattern and AI exposure risk. It can restrict bulk export, prevent external sharing, flag abnormal activity, trigger review workflows and generate audit evidence, protecting the data even after access is granted.
Technology enablers
Implementation roadmap
HCLTech point of view
The future security boundary is the data itself. HCLTech believes Data-Centric Zero Trust should be positioned as an enterprise security transformation program that brings together identity, data security, cloud security, AI governance, cryptography, access governance and compliance reporting.
- Move beyond identity-only control: Identity verification remains essential, but data security maturity requires controls that validate usage, exposure and movement.
- Build visibility before enforcement: Organizations should first establish trusted data discovery, classification and ownership visibility before scaling enforcement.
- Make governance operational: Data ownership, access reviews, policy exceptions and remediation should be linked to enterprise workflows and audit evidence.
- Treat AI as a data exposure channel: AI introduces new data movement paths; data-centric controls should evaluate sensitive information entering prompts, models and generated outputs.
- Measure outcomes: Leadership dashboards should show sensitive data exposure, excessive access, policy violations, remediation progress and risk reduction over time.
Conclusion: Trust must follow the data
Zero Trust began as a response to the limitations of perimeter-based security. It matured through identity-centric control. Now it must evolve again, into a data-centric model that continuously verifies whether data access and usage are appropriate.
The next generation of mature security programs will not only know who accessed data. They will know what data exists, where it resides, who owns it, who can access it, how it is used, where it moves and whether that usage is acceptable.
In a world where data is everywhere, trust cannot stop at identity. Trust must follow the data itself.
