From payment transactions to AI workflows, sensitive information moves through more systems and access paths than traditional security models were designed to handle. A new KuppingerCole Analysts report puts the need for data-layer enforcement into focus.
A payment transaction may begin at a terminal, but the data involved rarely stays in one place. It can pass through processors, banks, applications and downstream services. In other industries, similar patterns emerge as sensitive records are copied into analytics platforms, cloud environments and AI workflows.
For security teams, this raises a practical question: once sensitive information leaves the system where it was first collected, what protection goes with it?
The cost of exposure is already substantial
KuppingerCole Analysts' Leadership Compass: Data Security Platforms, published on 4 November 2026, cites a global average data-breach cost of $4.99 million. Its public summary also reports that 53% of breached organizations did not encrypt sensitive data at rest and in motion, while another 10% did not know whether their sensitive data was encrypted.
These figures are not measurements of the vendors evaluated in the Leadership Compass. They are broader breach-related findings cited by the research. Their significance is straightforward: even established protection practices are inconsistently applied.
Encryption remains essential. But protecting storage or transport does not automatically resolve what happens when an authorized application, service or user needs access to data in usable form.
AI introduces more access paths
The report also notes that one in five organizations reports an AI-related breach. Among organizations reporting such a breach, 92% lacked proper AI access controls.
The relevant change is not simply the introduction of another technology. Data is increasingly accessed by services, APIs, automated processes and AI-enabled systems. Security architectures need to account for these non-human access paths with the same care they apply to human users.
This is especially important when organizations want to use sensitive information for analytics, automation and AI without making it unnecessarily available in plaintext.
Discovery tells you where to look. Enforcement determines what happens next.
Data discovery and classification remain foundational. They help teams identify sensitive information and understand where it resides. Yet an inventory does not itself prevent inappropriate exposure.
KuppingerCole's assessment emphasizes the need for protection policies that operate at or near the data layer. The report examines how platforms combine discovery, classification, protection, governance and monitoring, and stresses that integration is where platform claims need to be tested.
The architecture matters more than the label. A useful evaluation asks whether a security control can actually be enforced in the applications and workflows where sensitive information is accessed.
What this means for payment data
Consider a payment-card number moving through a transaction workflow. Transport encryption protects a communication channel. Database encryption can protect stored records. Both are important, but neither alone guarantees that downstream applications will avoid unnecessary access to the original sensitive value.
Data-centric approaches, including tokenization, can help reduce that exposure. Where systems are appropriately integrated, applications may be able to work with tokens instead of the original payment data. This can support operational processes while limiting where sensitive values are present and who needs access to them.
Implementation details matter. Tokenization is not a universal substitute for encryption, access governance or PCI DSS controls. Its effectiveness depends on where values are transformed, where original data is retained, how detokenization is controlled and how the wider workflow is designed.
Security as an innovation enabler
At comforte, we see this as a question of what organizations should be able to do with data, not only what they must prevent. Financial institutions and enterprises need to modernize payment infrastructure, connect services and explore AI-enabled use cases. Security architecture should make those initiatives safer to pursue.
Our German-engineered approach to data-centric protection focuses on reducing unnecessary exposure of sensitive information while enabling authorized business use. Tokenization is one important part of that approach, alongside the other controls a complete architecture requires.
KuppingerCole lists comforte among its Vendors to Watch in this edition. That is a distinct category from the 21 vendors evaluated in the main assessment and should not be interpreted as a leadership ranking or endorsement.
The useful question for CISOs, payment architects and technology leaders is therefore not simply how much sensitive data they have discovered. It is this:
When sensitive data moves into the next application, API or AI workflow, which controls still protect it?
That question deserves an architectural answer, backed by testing rather than a dashboard or product label.
Research reference: Alexei Balaganski, Leadership Compass: Data Security Platforms, KuppingerCole Analysts, 4 November 2026. https://www.kuppingercole.com/research/lc81060/data-security-platforms
Editorial note: Statistics are cited from the report's publicly accessible summary. The full report requires a subscription. This article is comforte's independent interpretation and does not imply KuppingerCole endorsement.
