Network Security and DLP Can't Stop Agent Exfiltration | Nati Hazut | Bold Security
Source: YouTube · Cloud Security Podcast · published Aug 19, 2026 · 33:27
BLUF: Nati Hazut argues that traditional cloud-centric and browser-only security models are insufficient for AI data protection, advocating for a localized, endpoint-based approach to enable real-time prevention and comprehensive visibility across all AI interactions. 1:20
Key Takeaways:
• Traditional DLP and DSPM tools are often reactive and rely on sampling, leaving organizations vulnerable to data exfiltration via AI agents that operate outside these monitored channels 0:35.
• Securing AI on the endpoint is critical because data flows through diverse vectors like CLI, local agents, and unmanaged browsers, which cloud-based or browser-only solutions cannot fully inspect 4:20.
• Local AI models on endpoints allow for real-time prevention of risky actions and protect user privacy by avoiding the need to send sensitive data to third-party cloud servers 10:40.
• Organizations must move beyond simple URL blocking to manage the connection between internal knowledge bases and external or personal MCPs, which often happen by mistake 0:49.
• The industry is shifting toward "zero policy" visibility, using AI to automatically detect risky data flows and user behaviors without requiring extensive manual configuration 21:40.
Closing Statement:
As AI adoption accelerates, security strategies must evolve from static perimeter controls to dynamic, context-aware endpoint protection. Organizations that prioritize real-time visibility and prevention at the point of interaction will be best positioned to mitigate the expanding AI attack surface.
Sources:
- 0:15 Overview of the increasing AI attack surface and industry readiness.
- 0:35 Limitations of current DSPM and DLP tools, including data sampling trade-offs.
- 0:49 Risks associated with connecting internal MCPs to personal or public endpoints.
- 1:20 Introduction to the conversation with Nati Hazut regarding AI ecosystem visibility.
- 4:20 The necessity of endpoint security as AI expands beyond browsers.
- 10:40 Benefits of local AI models for real-time prevention and privacy.
- 21:40 The concept of "zero policy" for automated risk detection.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
If you want to steal files, go big. Because if you go big, it's just they won't even try to scan it, so they just let it pass. You'll find it with all the vendors, I promise you. >> Like, why is my DLP not enough? >> This attack surface is just increasing, and as an industry, we're not ready. We're still using those old tools that's been around for 20, 30 years. With AI, you're sharing data with an agent. It's and the memory of this agent, and there's a potential of this agent to take this data outside. If you go to the CISOs, they'll tell you that a day after a POV, they're starting with the trade-offs. And trade-offs are data sampling. Scan 5% of your data. Scan it once a month. An AI agent decided that my machine should listen on a TCP port for whatever incoming connection. Internal MCP…