When 'Who Touched The Data' Is No Longer A Person

InnovationWhen 'Who Touched The Data' Is No Longer A PersonByAriel Zamir,Forbes Councils Member.for Forbes Technology CouncilCOUNCIL POSTExpertise from Forbes Councils members, operated under license. Opinions expressed are those of the author. | Membership (fee-based)May 11, 2026, 08:45am EDTAriel Zamir is Co-Founder & CEO of Ray Security. gettyAsk any security leader what the most fundamental question in data protection is, and the answer is always the same: Who touched the data?Every audit, incident investigation and compliance review begins there. Access logs exist to answer it. Regulators demand it after a breach. When something goes wrong, boards want to know exactly who accessed sensitive information, when it happened and why.For decades, the question carried an assumption so obvious it was rarely stated. “Who” meant a person, an employee, contractor or partner with credentials tied to an identifiable individual. Data security programs were built around that assumption.That assumption is now breaking.The most consequential shift in data security today is not a new attack technique. It is that the definition of “who” has changed, and many security programs have not yet adapted.​A New Class Of ActorAgentic AI refers to autonomous systems capable of retrieving information, making decisions and executing multistep tasks without continuous human direction. Unlike chat-based tools, these systems act. They query databases, access documents, call APIs and move data between systems to complete workflows.They are already embedded in enterprise environments, supporting research, automating financial processes and coordinating operations. Their activity is often larger in scale, and faster in execution, than that of human users.Research from Obsidian Security found that AI agents can move significantly more data than humans. In one documented case, a single agent downloaded over 16 million files, while all other users and applications combined accounted for...