Protecting sensitive business data in preparation for the organization's Gen AI

This piece argues that as enterprises adopt generative AI tools (e.g., Microsoft Copilot, Google Gemini), traditional security approaches focused on systems and structured data are inadequate for protecting unstructured sensitive information like CUI. It explains how GenAI’s answer-centric model, broad data access, and streamlined rollout heighten risk, and frames key questions around identifying, locating, trusting, accessing, and properly handling sensitive data. The author calls for capabilities to inventory sensitivity without manual markings, protect the data itself, verify integrity and provenance of answers, and monitor both direct and indirect access and usage to enable responsible AI deployment.