Just like that, another ISC2 Security Congress has come and gone. Last year we were in Nashville, and this year we were slightly more elevated in Denver. The location changed, but ISC2 remains an excellent opportunity to see where security programs are focusing their attention.
Before the event, we flagged four sessions and read each one through the same question: what can an intruder, an overprivileged service account, or an AI agent read once access is granted or taken? Lo and behold, we came away with takeaways that continue to support data-centric security.
Perimeter investments are growing while data continues to move
Gartner forecasts information security spending of roughly $249 billion in 2026. By our read, about 97% goes to the places and pathways that data travels through, such as network, endpoint, identity, email, and AI security. The remaining 3% ($7.8 billion) goes to data security.
That split matters because the two categories do different jobs, which may be funded differently. Spending on places and pathways reduces the likelihood that an attacker gets in by building bigger walls or alerting when those walls are breached. Most data security spending operates in the same way: finding and flagging data risk rather than protecting the data itself. Only a tiny fraction of that 3% goes to controls that reduce consequences when a boundary fails, by keeping the data unreadable to anyone not authorized to access it.
And because sensitive data can’t stay inside the systems an organization controls forever, bigger walls won't always keep data safe. Documents move to cloud platforms, outside partners, suppliers, and AI tools as part of normal work, and each move takes the file beyond the controls built to protect it. That gap sits underneath all three takeaways.
Takeaway One: Bigger walls will eventually break
In almost every booth conversation, we discussed investing in stronger perimeters, such as additional monitoring, AI governance solutions, and tighter identity checks. These are examples of what makes up the 97%, and all help reduce the likelihood of a breach rather than its consequences. These controls matter, but they assume sensitive data is safe as long as bad actors stay out or the data stays in.
Boundaries protecting data will fail in one of two ways: either attackers find a way past them and access data, or the data leaks out. The second failure is often harder to spot because a leak rarely looks like a breach. More often, it’s a misrouted email, a third party with weaker controls, or an AI tool with broader access than anyone intended.
As we wrote ahead of the Congress, zero trust stays incomplete when protection isn’t bound to the data itself, because identity, network, and device controls don’t protect a file that becomes broadly readable once access is granted. The more durable approach is to secure sensitive information at the source, so its protection travels with the file in motion, at rest, and in use.
Takeaway two: GRC had a seat at the table
Governance, risk, and compliance (GRC) professionals had a noticeable presence at this year’s Congress. We at Confidencial believe that presence reflects how closely GRC and security now depend on each other. GRC teams set the governance structure, risk frameworks, and compliance processes that guide security strategy, while security teams deliver the technical controls that put those requirements into practice.
GRC’s focus is the organization’s overall exposure, whether regulatory, contractual, or reputational, and meeting a security framework is not the same as protecting the data behind it. In fact, when we asked conference attendees how their organizations manage sensitive unstructured data, many said ‘not well’.
Part of the challenge is that sensitive documents and files have to move outside the organization to get business done, and once they leave, the controls built around them no longer apply. In our conversations at the booth, this was where GRC and security interests met: protection that stays with the data in motion, at rest, and in use.
One of the sessions we flagged before the event, Framework to Function, was described as a move from static compliance toward continuous risk management, including supplier and service provider risk. That kind of shift depends on knowing where sensitive data goes after it leaves the organization’s own systems. For GRC, that visibility also needs evidence, such as audit trails showing who accessed sensitive content and when.
Protection that stays with the data also changes what a breach costs. If an attacker gets in, or a file ends up somewhere it shouldn’t, encrypted content limits the blast radius. Reducing the consequence of an incident, and not only its likelihood, matters to the security team responsible for the response and to the GRC team responsible for the exposure.
Takeaway Three: It’s Not What They Break Into, It’s What They Leave With
On Day 3 of ISC2 Security Congress, Karim Eldefrawy, Co-Founder and CTO of Confidencial, presented “It’s Not What They Break Into, It’s What They Leave With.” The session started with a standard definition: risk is the likelihood of an incident multiplied by its consequence. It then shifted to how organizations got there.
For two decades, security has been bought to protect places, including the network, file servers, the DMS, email, laptops, data rooms, and now collaboration tools and AI assistants. Each new pathway tends to arrive before the control built for it. For example, SaaS adoption came before CASBs caught up, and generative AI is following the same pattern, with controls lagging. All this is happening while sensitive data moves farther, faster, and becomes easier to reach. Concentric AI’s 2025 Data Risk Report found that sensitive records shared externally made up more than half of all shared files, averaging over three million records per organization, while LayerX’s 2025 research found that organizations have no visibility into 89% of AI usage. This, Eldefrawy argued, reinforces the need for data-centric protection that holds in motion, at rest, and in use.
The live demo showed three views of the same document: what it looks like to someone authorized to read it, what it looks like to someone who isn’t, and what an AI model can still do with it.
The session closed on the roadmap. Many programs assume protection comes last, after discovery, classification, tagging, control, and monitoring are complete. The alternative, however, is to start protecting high-risk pathways, such as email to outside counsel, data room uploads, external share links, and files sent to AI tools, while discovery and classification continue in parallel. That way, the consequence of a breach starts to drop with the first protected file rather than years later.
What this means for security leaders
Following ISC2 Security Congress 2026, the Confidencial team came away with three takeaways that share a common thread. Organizations continue to invest in bigger walls, GRC professionals showed clear interest in protecting sensitive data, and our session made the case that risk depends as much on what attackers leave with as on what they break into. Each takeaway points to the same gap: most security spending reduces the likelihood of a breach, while far less goes to reducing its consequence.
Closing that gap does not mean replacing perimeter controls. Rather, it means adding protection that stays with the data itself, so a misrouted file, a compromised credential, or an AI tool with too much access exposes more than it should. This kind of protection also gives security and GRC teams common ground, since both can work from the same record of which sensitive data is readable, and by whom.
The pressure behind this shift is likely to grow. New pathways, from AI agents to the next generation of collaboration tools, tend to arrive before the controls built for them, and sensitive data will keep moving outside the organization to get business done. Organizations that protect the data first are better prepared for whatever pathway comes next, because their protection doesn’t depend on that pathway’s controls catching up.