Finding the Blind Spots in Your Data Environment

Where risk tends to hide in the data tier and how IT teams can start bringing it into view

‍

Picture a developer troubleshooting a slow query late on a Thursday afternoon. To save time, they take a screenshot of the execution plan, paste it into a public AI chatbot and ask what's wrong. The chatbot suggests a missing index, and the developer applies the fix and moves on to the next ticket. The screenshot stays behind on a system the organization doesn't control, along with every table name and server detail that was visible in it.

‍

No alert fires when that happens, because nothing in the moment looks like an attack. The developer was trying to work quickly and accurately, and the tools the security team relies on weren't built to notice a screenshot leaving through a browser tab. Gaps like this exist in many data environments, and because nothing flags them, organizations often don’t have visibility until a problem surfaces. For Cybersecurity Awareness Month this October, we're looking at four places in the data tier where those gaps tend to form and what IT teams can do to close them.

‍

Sensitive data is flowing into AI tools

‍

Many organizations already suspect some version of that screenshot scenario is happening inside their walls, and the cost of loose data handling around AI will show up in IT workloads for years. Gartner predicts that through 2030, a third of IT work will go toward remediating AI data debt, much of it tied to poorly secured and unstructured data, and security leaders are expanding data loss prevention to monitor and restrict data flows triggered by generative and agentic AI. Blocking public AI sites helps at the margins, though someone can still photograph a screen with a phone or copy text out of a remote session, and no VPN setting will stop either one. Giving employees approved AI tools reduces the temptation to work around policy. Organizations are paying closer attention to their vendors as well, and more of them now ask managed services partners directly whether their teams use AI and, if so, whether those tools run on secured enterprise versions. We'd encourage any organization to ask its partners the same thing.

‍

Non-human identities are multiplying

‍

Service accounts and AI agents need credentials to reach the data they work with, and organizations have been creating them quickly as they automate more of their operations. In an April 2026 release, Gartner predicted that the average global Fortune 500 enterprise will have more than 150,000 agents in use by 2028, while only 13% of organizations believe they have the right governance in place for them. Many of these identities were set up for a single project and never revisited, which means they often carry broader permissions than anyone on the current team remembers granting. A person who makes a destructive mistake in a database, whether deliberately or by accident, usually gets noticed before the damage spreads very far. An agent with excessive access works at machine speed, and the identity controls built for people, such as single sign-on and multifactor authentication, don't translate cleanly to an API.  

‍

More security teams now ask vendors during onboarding whether any non-human identities will touch their environment, and some refuse them entirely. Gartner also expects that by 2028, 70% of CISOs will use identity visibility and intelligence capabilities to shrink the identity attack surface, as human and machine identities grow more complex than isolated tools can track. Visibility tools help, and in our view the work starts with a plain inventory, because a data team can't review access for accounts it doesn't know exist. Keeping a current list of every account and integration that can reach the data tier, along with the reason each one needs that access, makes it much easier for security teams to spot the ones that no longer belong.

‍

AI activity often goes unmonitored

‍

Most monitoring in the data tier was built around operational questions, such as whether a database is available and whether queries are running within normal ranges. Those checks remain essential, though they say very little about what an AI tool or agent did once it connected to production data. Few organizations can see which tables an AI tool read or whether its output was accurate. Gartner predicts that by 2028, half of all enterprise incident response efforts will focus on incidents involving custom-built AI applications, many of which are deployed before they've been fully tested. Logging every AI connection to the data tier and reviewing that activity on a regular schedule is a reasonable place to start, and it gives the team a baseline to compare against as AI use grows.

‍

Older systems carry risk that's easy to overlook

‍

Plenty of organizations still run operating systems and database versions past their end-of-support dates, including large, well-established companies. One long-standing organization that was once a billion-dollar business recently found that none of its SQL Servers were still within Microsoft's support window. Systems that keep running reliably are easy to leave alone, especially when a team's attention is on daily operations.

‍

Each month on an unsupported platform adds to a list of known vulnerabilities with no patch coming, and some of these environments have stayed safe largely because no one has targeted them yet. For years, running many different technologies offered some protection, since an attacker had to break into each system separately and that took time and specialized skill. Automated tools now work through a long list of systems much faster than a person could, which removes most of the cover that complexity used to provide. A practical first step is a written inventory of every platform in the environment, its support status and the applications that depend on it, which gives the business a modernization plan it can budget for.

‍

Experienced people still make the call

‍

Automated tools can show a team more of what's happening in its environment, but an experienced person still has to decide what the findings mean and when to shut something off. That judgment comes from knowing the data tier well enough to tell which accounts belong there and which AI integrations the business actually approved. For many organizations, that knowledge sits with a mix of internal staff and a managed services partner working as an extension of the team. DataStrike's 100% onshore team supports the databases and data platforms behind more than 200 organizations. If your environment includes database platforms that are past support or haven't had a close look in a while, the DataStrike team can help you see where things stand and keep those systems current going forward.

Frequently Asked Questions (FAQs)

‍

What is shadow AI?

‍

Shadow AI refers to AI tools employees use for work without approval from IT or security teams, such as a public chatbot or a personal AI account. The concern is the data that goes into those tools, since screenshots and customer records pasted into an unapproved service leave the organization's control, often without any record that it happened.

‍

Why are unsupported database versions a security concern?

‍

Once a database platform passes its end-of-support date, the vendor stops releasing security updates for it. Any vulnerability discovered after that point stays open unless the organization pays for extended support or upgrades to a supported version. Microsoft publishes fixed end-of-support dates for each SQL Server release, which makes it possible to plan upgrades well before a version falls out of coverage.

‍

How can IT teams see what AI tools are doing with their data?

‍

Database audit features in platforms like SQL Server and Oracle can record which accounts connect and which objects they query. Giving each AI tool its own dedicated account makes that activity easy to separate from human users, and reviewing those logs on a regular schedule gives the team a baseline for spotting unusual behavior.

‍

Where should an organization start if it doesn't know what can reach its data?

‍

The most useful first step is an inventory of every account and AI tool that can reach production databases, with a note on why each one needs access. Any entry that nobody can explain is worth investigating. The same exercise should capture the version and support status of each database platform, which shows the business where upgrades belong on the roadmap.

‍

How does a managed database partner fit into this work?

‍

A managed database partner handles the work that keeps the data tier stable over time, including patching and version upgrades along with ongoing monitoring. DataStrike's onshore DBAs provide that support as an extension of each client's internal IT team, so database platforms stay current long after the initial upgrade is done.

‍

About DataStrike ‍

‍

DataStrike is the industry leader in 100% onshore data infrastructure services and enables companies to harness IT changes as a catalyst for growth. With a network of highly specialized experts, strategic partnerships with the world's biggest technology providers, and a platform agnostic approach, DataStrike provides innovative solutions and practical guidance to accelerate digital transformation initiatives and drive better business outcomes for small-to mid-sized businesses. Click here to learn more about our service offerings.