Executive summary
Zero Trust has helped enterprises strengthen identity and access controls, but the next security challenge begins after access is granted. Sensitive data now moves across SaaS, cloud, endpoints, collaboration platforms and AI systems. A verified identity does not automatically mean safe data usage. The next evolution is Data-Centric Zero Trust: continuously discovering, classifying, governing, protecting and monitoring data based on context, exposure and behavior.
The evolution from perimeter to identity to data
Zero Trust has become one of the defining principles of modern cybersecurity. It has traditionally focused on identity and access management through the principle: “Never trust, always verify.” Enterprises have invested in identity verification, multi-factor authentication, privileged access controls and access governance.
However, a critical question remains: what happens after access is granted? A user may be authenticated, an application may be approved and a session may be valid, yet sensitive data can still be copied, downloaded, shared, uploaded to AI tools or exposed through excessive permissions.
The next evolution of Zero Trust is therefore clear: security must extend beyond identity and follow the data itself.
The limitation of identity-centric Zero Trust
Identity-centric Zero Trust reduces unauthorized access, but it does not fully control authorized misuse, accidental exposure or risky data movement. Traditional controls focus on whether a user should access a system; data-centric controls ask whether the user should access this specific data, in this context, for this purpose, at this time.
| Traditional control | Remaining gap | Data-centric response |
| Authenticate user | User may still see or export too much data | Evaluate sensitivity, purpose and exposure |
| Authorize application access | Application access does not equal data-level need | Apply least privilege at file, record and dataset level |
| Grant privileged access | Privileged users can create high-impact data exposure | Monitor data use, volume and sharing behavior |
| Trust approved devices | Data can still be copied, synced or uploaded externally | Control data movement and enforce policy at the data layer |
Why data needs its own Zero Trust model
- Data is highly distributed: Enterprise data resides across multi-cloud environments, SaaS platforms, endpoints, collaboration tools, databases, data lakes and AI systems. There is no single perimeter where data can be fully contained.
- Identity does not equal trust: Legitimate users can accidentally share sensitive information, misuse excessive privileges or move data into uncontrolled locations. Verification of identity must be complemented by verification of data usage.
- AI has changed data movement: GenAI, copilots and automation can consume, transform and generate sensitive information. Data may enter prompts, model workflows, third-party services or AI-generated outputs, creating exposure paths that identity controls alone cannot govern.
- Exposure defines risk: Risk is no longer based only on whether data is sensitive. It is based on sensitive data plus exposure: who can access it, where it has moved, whether it is over-permissioned and whether its usage pattern is appropriate.
Five pillars of Zero Trust for data
| Pillar | Objective | Key questions | Example controls |
| Discover | Find data across enterprise environments | Where is sensitive data located? | Discovery scans, DSPM, data mapping |
| Classify | Understand sensitivity and business criticality | What type of data is it? | Labels, taxonomy, privacy/regulatory tags |
| Govern | Define ownership, policy and accountability | Who owns it and who should access it? | Access reviews, entitlement mapping, CMDB/metadata ownership |
| Protect | Apply data-level security controls | How should it be secured? | Encryption, DLP, DRM, masking, tokenization |
| Monitor | Continuously validate usage and exposure | Is the data being used appropriately? | Behavior analytics, sharing alerts, insider-risk monitoring |
Core capabilities required
| Capability | What it enables | Business outcome |
| Continuous data visibility | Know where data resides, who accesses it and how it moves | Reduced blind spots and improved audit readiness |
| Context-aware access | Evaluate user role, device, location, sensitivity, behavior and business purpose | Dynamic access decisions instead of static permissions |
| Least privilege for data | Limit users to only the data required for their role | Lower exposure and reduced insider-risk impact |
| Real-time data usage monitoring | Detect abnormal downloads, unusual sharing and high-risk movement | Earlier detection of risky behavior |
| Policy enforcement at data level | Restrict external sharing, copying, bulk download and uncontrolled AI usage | Protection that follows data beyond application access |
Identity-centric vs data-centric Zero Trust
| Dimension | Identity-centric Zero Trust | Data-centric Zero Trust | Why it matters |
| Primary focus | User, device and application access | Data sensitivity, exposure and usage context | Reduces risk after access is granted |
| Control point | Login and session initiation | Entire data lifecycle | Protects create, access, copy, share, export and archive stages |
| Trust decision | Verified identity is allowed | Data usage is continuously verified | Prevents over-reliance on authentication alone |
| Risk model | Access-based | Exposure- and behavior-based | Highlights sensitive data with excessive access |
| Policy model | Static access policy | Dynamic, context-aware enforcement | Adapts to location, device, behavior and sensitivity |
Real-world scenario: Financial services and AI usage
Consider a financial analyst with legitimate access to confidential revenue and customer data. In a traditional Zero Trust model, the analyst is authenticated and granted access to the financial system. But if the analyst exports a large dataset, uploads it to an external AI tool or shares it with a broader audience, the data risk increases even though the identity decision was correct.
Data-centric response
A data-centric Zero Trust model evaluates the type of data, access volume, user behavior, destination, sharing pattern and AI exposure risk. It can restrict bulk export, prevent external sharing, flag abnormal activity, trigger review workflows and generate audit evidence, protecting the data even after access is granted.
Technology enablers
| Capability area | Technology enabler | Role in Zero Trust for data |
| Data discovery and classification | DSPM / data classification platforms | Identify sensitive data and maintain visibility across cloud, SaaS and repositories |
| Data access governance | DAG / entitlement analytics | Map permissions, owners and excessive access to sensitive data |
| Data loss prevention | DLP and information protection | Prevent unauthorized sharing, copying, printing and external transmission |
| Insider risk management | Behavior analytics and risk workflows | Detect risky or unusual user behavior involving sensitive data |
| Encryption and key management | HSM, KMS and encryption platforms | Protect data confidentiality and enforce cryptographic controls |
| AI governance | AI usage monitoring and prompt/data controls | Govern sensitive data entering AI workflows and generated outputs |
Implementation roadmap
| Phase | Objective | Activities | Outputs |
| 1. Assess | Understand current data exposure and maturity | Review data stores, access models, sensitive data locations and high-risk business processes | Baseline assessment and risk heatmap |
| 2. Discover and classify | Create trusted data visibility | Scan repositories, classify sensitive data, map owners and identify critical assets | Data inventory and classification model |
| 3. Govern | Define policy and accountability | Create ownership, access review cadence, exception workflow and data usage policies | Governance model and policy framework |
| 4. Protect | Enforce data-level controls | Implement DLP, encryption, least privilege, sharing restrictions and AI usage controls | Control implementation plan |
| 5. Monitor and optimize | Continuously improve posture | Track exposure, user behavior, policy exceptions, incident trends and audit evidence | Dashboards, KRIs and continuous improvement backlog |
HCLTech point of view
The future security boundary is the data itself. HCLTech believes Data-Centric Zero Trust should be positioned as an enterprise security transformation program that brings together identity, data security, cloud security, AI governance, cryptography, access governance and compliance reporting.
- Move beyond identity-only control: Identity verification remains essential, but data security maturity requires controls that validate usage, exposure and movement.
- Build visibility before enforcement: Organizations should first establish trusted data discovery, classification and ownership visibility before scaling enforcement.
- Make governance operational: Data ownership, access reviews, policy exceptions and remediation should be linked to enterprise workflows and audit evidence.
- Treat AI as a data exposure channel: AI introduces new data movement paths; data-centric controls should evaluate sensitive information entering prompts, models and generated outputs.
- Measure outcomes: Leadership dashboards should show sensitive data exposure, excessive access, policy violations, remediation progress and risk reduction over time.
Conclusion: Trust must follow the data
Zero Trust began as a response to the limitations of perimeter-based security. It matured through identity-centric control. Now it must evolve again, into a data-centric model that continuously verifies whether data access and usage are appropriate.
The next generation of mature security programs will not only know who accessed data. They will know what data exists, where it resides, who owns it, who can access it, how it is used, where it moves and whether that usage is acceptable.
In a world where data is everywhere, trust cannot stop at identity. Trust must follow the data itself.
