---
title: "Data Security: Controls That Travel With the Data | Lattix"
description: Data security protects information itself, not just the systems holding it. Coverage of classification, key custody, DLP limits, and cryptographic enforcement.
source: "https://lattix.io/blog/topics/data-security/"
content-type: text/markdown
---

# Data Security: Controls That Travel With the Data | Lattix

[Blog](https://lattix.io/blog/) [Topics](https://lattix.io/blog/topics/) Data Security

Topic

# Data Security

What protects information once it leaves the systems you control, and how classification, keys, and cryptography divide the work.

78posts

Data security is the practice of protecting information itself rather than the systems and networks that hold it, so protection survives copying, forwarding, and export. Data-centric security binds policy to the object, which turns every open into an access decision instead of trusting a single decision made at a boundary. Cryptographic enforcement makes that decision unavoidable: without a key release from the policy decision point (PDP), the bytes stay ciphertext.

Practitioners routinely confuse posture with enforcement. Discovery and classification tools report where sensitive data sits and who can reach it, but they do not stop an authorized user from forwarding a file. Data loss prevention inspects traffic at egress points it controls, so it has nothing to say about the copy that already left.

Posts under this hub separate what DLP, DRM, DSPM, and data-centric security each enforce, and cover classification, key custody, Merkle-tree lineage for provenance, post-quantum key encapsulation, and crypto agility. Regulatory posts address HIPAA, PCI DSS 4.0.1, DORA, and CMMC, and breach analyses trace which layer failed.

## Frequently asked questions

### What is data-centric security?

Data-centric security attaches protection and policy to the data object rather than to the network, device, or application around it. The object stays encrypted, and each attempt to open it triggers an authorization decision that releases a key or refuses one. Protection therefore persists after download, forwarding, or export, in environments the originating organization does not operate or monitor.

### What is the difference between DLP, DRM, and DSPM?

Each enforces at a different point. Data loss prevention inspects content in motion at egress channels it controls and blocks matching transfers. Digital rights management controls what a rendering application permits after a file opens. Data security posture management discovers and reports where sensitive data lives and who has access, producing findings rather than enforcement decisions.

### How do you protect data after it leaves your network?

Encrypt the object and keep the authorization decision separate from the file. When the encryption is bound to a policy, opening the file requires contacting a policy decision point that evaluates current attributes and either releases the key or refuses. Because the check happens at decrypt time, revocation and attribute changes take effect on copies already sitting on other people's disks.

### Who should hold the keys in a data-centric architecture?

The data owner, through a key service the owner controls, separate from whoever stores the ciphertext. Splitting custody from storage means a cloud provider, hosting partner, or compromised repository holds bytes it cannot read. It also keeps revocation meaningful, since withdrawing key release stops future access regardless of how many copies exist elsewhere.

## Reading on data security

[![Lattix branded cover for What Is Data-Centric Security: A Technical Reference. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a single data object carrying a classification label, a bound access policy and an encrypted payload.](https://lattix.io/images/blog/what-is-data-centric-security-cover.svg) What Is Data-Centric Security: A Technical Reference August 22, 2026 Data-centric security attaches classification, access policy and cryptographic protection to the data object itself. Every read triggers a fresh authorization decision, so the control survives the loss of the network, device or application holding the object. Read More →](https://lattix.io/blog/what-is-data-centric-security/)

[![Lattix branded cover for What Is Trusted Data Format: A Technical Reference. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing an encrypted payload nested inside a manifest that carries a bound access policy.](https://lattix.io/images/blog/what-is-trusted-data-format-cover.svg) What Is Trusted Data Format: A Technical Reference August 22, 2026 Trusted Data Format is an open specification that wraps a file in an encrypted envelope carrying its own access policy, so the policy travels with the object and is checked every time the object is opened. Read More →](https://lattix.io/blog/what-is-trusted-data-format/)

[![Lattix branded cover for AI Agents Need Authorization Decisions, Not Guardrails. /43 section number, dark grid background with surgical yellow accent rules, IBM Plex Mono typography, a reference box contrasting probabilistic steering against an evaluated signed decision, and an attribute strip naming subject, device, environment, purpose, network, risk and object.](https://lattix.io/images/blog/ai-agents-need-authorization-decisions-not-guardrails-cover.svg) AI Agents Need Authorization Decisions, Not Guardrails August 21, 2026 Prompt filters and output classifiers steer a model. They do not authorize anything. An AI action request is an access request, and it belongs at a policy decision point that returns a signed allow or deny with the reasons attached. Read More →](https://lattix.io/blog/ai-agents-need-authorization-decisions-not-guardrails/)

[![Lattix branded cover for OpenTDF, TDF, and ZTDF: How the Three Terms Relate. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box separating a format, a profile of that format, and an implementation of it.](https://lattix.io/images/blog/opentdf-tdf-ztdf-terminology-cover.svg) OpenTDF, TDF, and ZTDF: How the Three Terms Relate August 21, 2026 TDF is a data object format. ZTDF is a coalition profile of that format. OpenTDF is the open-source specification and implementation. The three names are used interchangeably in the market and refer to different things. Read More →](https://lattix.io/blog/opentdf-tdf-ztdf-terminology/)

[![Lattix branded cover for What Is Persistent Data Protection. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing one encrypted file leaving an organizational boundary while its bound policy and key request path remain attached.](https://lattix.io/images/blog/what-is-persistent-data-protection-cover.svg) What Is Persistent Data Protection August 21, 2026 Persistent data protection keeps an access policy bound to a data object for the life of that object, including after it is copied or downloaded to an unmanaged device. Opening the object requires a fresh authorization decision, not possession of the file. Read More →](https://lattix.io/blog/what-is-persistent-data-protection/)

[![Lattix branded cover for Zero Trust Data Security in 2026: The Standards Map. /45 section number, dark grid background with surgical yellow accent rules, IBM Plex Mono typography, a reference box grouping the standards by the question each one settles, and a strip naming architecture, implementation, measurement, sequencing, cryptographic floor and AI systems.](https://lattix.io/images/blog/zero-trust-data-security-2026-standards-map-cover.svg) Zero Trust Data Security in 2026: The Standards Map August 21, 2026 Nine documents govern zero trust data security in 2026, and each settles a different question. This is the map of which standard answers what, and the one question none of them answers for you. Read More →](https://lattix.io/blog/zero-trust-data-security-2026-standards-map/)

[![Lattix branded cover for Data-Centric Security vs Zero Trust: How the Two Relate. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing five zero trust pillars and a bound policy sitting inside the data pillar.](https://lattix.io/images/blog/data-centric-security-vs-zero-trust-cover.svg) Data-Centric Security vs Zero Trust: How the Two Relate August 20, 2026 Zero trust is the framework. Data-centric security is how its data pillar gets built. Zero trust governs identity, devices, networks, applications and data; data-centric security governs the last of those at the object rather than at the path. Read More →](https://lattix.io/blog/data-centric-security-vs-zero-trust/)

[![Lattix branded cover for What Is a Policy Decision Point. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a request arriving at a decision component and a signed allow or deny answer returning to an enforcement component in the request path.](https://lattix.io/images/blog/what-is-a-policy-decision-point-cover.svg) What Is a Policy Decision Point August 20, 2026 A policy decision point evaluates an access request against policy and returns allow or deny. NIST SP 800-207 splits it from the enforcement point, and that split is what makes real-time authorization possible. Read More →](https://lattix.io/blog/what-is-a-policy-decision-point/)

[![Lattix branded cover for ABAC, RBAC and ReBAC: Which Model Answers Which Question. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing three policy models side by side above a single data object that each one describes differently.](https://lattix.io/images/blog/abac-rbac-rebac-compared-cover.svg) ABAC, RBAC and ReBAC: Which Model Answers Which Question August 19, 2026 RBAC grants by role, ABAC evaluates attributes at request time, ReBAC traverses relationships between subjects and objects. All three decide who may act. None of them decides whether a specific object should open under current conditions. Read More →](https://lattix.io/blog/abac-rbac-rebac-compared/)

[![Lattix branded cover for How TDF Enforces Access Policy at Decrypt Time. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box tracing a key request through attribute evaluation to a signed allow or deny.](https://lattix.io/images/blog/how-tdf-enforces-policy-at-decrypt-time-cover.svg) How TDF Enforces Access Policy at Decrypt Time August 19, 2026 A TDF object is opened by requesting its key, not by holding it. This reference walks the decrypt sequence from request through attribute evaluation to key release, and describes what the decision contains and what evidence it leaves. Read More →](https://lattix.io/blog/how-tdf-enforces-policy-at-decrypt-time/)

[![Lattix branded cover for Ransomware Doesn't Work on Policy-Bound Data. /10 section number, double-extortion failure metadata, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/ransomware-doesnt-work-on-policy-bound-data-cover.svg) Ransomware Doesn't Work on Policy-Bound Data August 19, 2026 Modern ransomware exfiltrates before it encrypts and demands payment under the threat of public release. Neither lever works when the data is already encrypted and policy-bound at the object layer. Read More →](https://lattix.io/blog/ransomware-doesnt-work-on-policy-bound-data/)

[![Lattix branded cover for TDF vs Traditional File Encryption: What Each One Enforces. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box contrasting a key held by a holder against a policy bound to an object.](https://lattix.io/images/blog/tdf-vs-traditional-file-encryption-cover.svg) TDF vs Traditional File Encryption: What Each One Enforces August 18, 2026 Traditional file encryption enforces key possession. Trusted Data Format enforces an access policy bound to the object and evaluated at every decrypt. Both are strong cryptography; they answer different questions. Read More →](https://lattix.io/blog/tdf-vs-traditional-file-encryption/)

[![Lattix branded cover for What Happens to DLP Controls After the File Is Downloaded. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing an inspection boundary behind a file that has already reached an unmanaged endpoint.](https://lattix.io/images/blog/what-happens-to-dlp-after-download-cover.svg) What Happens to DLP Controls After the File Is Downloaded August 18, 2026 DLP enforces at boundaries the organization operates. A completed download to an unmanaged device or account has crossed the last of those boundaries, leaving ordinary plaintext that DLP can record but no longer govern. Read More →](https://lattix.io/blog/what-happens-to-dlp-after-download/)

[![Lattix branded cover for DLP, DRM, DSPM and Data-Centric Security: What Each One Enforces. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing four control layers positioned at inspection, application, inventory and decrypt.](https://lattix.io/images/blog/dlp-drm-dspm-data-centric-security-compared-cover.svg) DLP, DRM, DSPM and Data-Centric Security: What Each One Enforces August 17, 2026 DLP inspects content at egress boundaries. DRM binds usage rights checked by a cooperating application. DSPM discovers and reports exposure without deciding access. Data-centric security binds policy to the object and evaluates it at every decrypt. Read More →](https://lattix.io/blog/dlp-drm-dspm-data-centric-security-compared/)

[![Lattix branded cover for Posture Is Not Enforcement: What DSPM Can and Cannot Do. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box separating an inventory and exposure map from a request-time allow or deny decision.](https://lattix.io/images/blog/dspm-posture-is-not-enforcement-cover.svg) Posture Is Not Enforcement: What DSPM Can and Cannot Do August 17, 2026 DSPM discovers data stores, classifies contents, maps permissions and prioritizes exposure findings. It is not in the request path, so it does not decide access. DSPM and an enforcement layer are complements: one supplies attributes, the other acts on them. Read More →](https://lattix.io/blog/dspm-posture-is-not-enforcement/)

[![Lattix branded cover for How to Revoke Access to a File Someone Already Downloaded. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a key unwrap request returning deny while the encrypted file remains on a remote disk.](https://lattix.io/images/blog/how-to-revoke-access-to-a-downloaded-file-cover.svg) How to Revoke Access to a File Someone Already Downloaded August 16, 2026 Revoking access to a downloaded file works only when the file was encrypted with a bound policy before distribution. Revocation changes the answer the key service gives at the next open. It prevents future key release and does not reach extracted plaintext. Read More →](https://lattix.io/blog/how-to-revoke-access-to-a-downloaded-file/)

[![Lattix branded cover for Data-Centric Zero Trust. /15 section number, policy-bound data object traversing trust boundaries with persistent enforcement, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-centric-zero-trust-policy-travels-with-data-cover.svg) Data-Centric Zero Trust: Policy That Travels With the Data August 14, 2026 Data-centric zero trust binds authorization, encryption, provenance, and revocation directly to the data object, so policy persists and enforces wherever the data goes, independent of infrastructure trust boundaries. Read More →](https://lattix.io/blog/data-centric-zero-trust-policy-travels-with-data/)

[![Lattix branded cover for Data Provenance vs Lineage vs Chain of Custody. /12 section number, three overlapping evidence circles with cryptographic seals, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-provenance-lineage-chain-of-custody-cover.svg) Data Provenance vs Lineage vs Chain of Custody: What Runtime Security Actually Needs August 14, 2026 Provenance tells you where data came from. Lineage shows how it transformed. Chain of custody proves who held it. Each answers a different security question, and conflating them weakens your evidence model. Read More →](https://lattix.io/blog/data-provenance-lineage-chain-of-custody/)

[![Lattix branded cover for How to Give an AI Agent Access to Sensitive Data Safely. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing an agent issuing repeated tool calls, each one hitting a separate authorization decision before any object opens.](https://lattix.io/images/blog/how-to-give-an-ai-agent-access-to-sensitive-data-cover.svg) How to Give an AI Agent Access to Sensitive Data Safely August 14, 2026 Give an AI agent a distinct identity, authorize each action rather than each session, require purpose as an asserted attribute, and enforce at the data object so derived artifacts stay governed. Read More →](https://lattix.io/blog/how-to-give-an-ai-agent-access-to-sensitive-data/)

[![Lattix branded cover for Protecting RAG Context and Agent Tool Outputs Across Trust Boundaries. Section number, data-flow trust boundary map, IBM Plex Mono on dark grid background, surgical yellow accent on policy enforcement points.](https://lattix.io/images/blog/protecting-rag-context-agent-tool-outputs-trust-boundaries-cover.svg) Protecting RAG Context and Agent Tool Outputs Across Trust Boundaries August 14, 2026 Modern AI systems copy, cache, retrieve, and forward data across multiple trust boundaries. Session-level authorization does not persist once data leaves its origin. A data-centric security model with persistent policy, contextual authorization, and cross-boundary evidence closes the gap. Read More →](https://lattix.io/blog/protecting-rag-context-agent-tool-outputs-trust-boundaries/)

[![Lattix branded cover for What Is Crypto Agility. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing an algorithm identifier being swapped beneath an unchanged application interface while the protected object stays in place.](https://lattix.io/images/blog/what-is-crypto-agility-cover.svg) What Is Crypto Agility August 14, 2026 Crypto agility is the capability to replace cryptographic algorithms in systems already running, without rewriting the applications that depend on them. It is the property that makes post-quantum migration a configuration change rather than a rebuild. Read More →](https://lattix.io/blog/what-is-crypto-agility/)

[![Lattix branded cover for Protecting CUI After It Leaves Your Network. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a CUI-marked object leaving a prime contractor boundary and still requiring a policy decision to open.](https://lattix.io/images/blog/protecting-cui-after-it-leaves-your-network-cover.svg) Protecting CUI After It Leaves Your Network August 13, 2026 Controlled Unclassified Information stays protected outside the boundary only when the access control is bound to the object rather than to the network. DFARS obligations, NIST SP 800-171 and SPRS submission remain in force through the CMMC reform review. Read More →](https://lattix.io/blog/protecting-cui-after-it-leaves-your-network/)

[![Lattix branded cover for How Coalition Partners Share Classified Data Without Shared Infrastructure. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a labelled object crossing between two national enclaves that share no common network.](https://lattix.io/images/blog/coalition-classified-data-sharing-reference-cover.svg) How Coalition Partners Share Classified Data Without Shared Infrastructure August 12, 2026 Coalition partners share classified data by binding a machine-readable confidentiality label to each object and enforcing release at the object, not by building a common network. STANAG 4774, STANAG 4778 and Federated Mission Networking define how. Read More →](https://lattix.io/blog/coalition-classified-data-sharing-reference/)

[![Lattix branded cover for Cross-Domain Solutions: A Practitioner Reference. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a guard appliance between a high-side and low-side domain and a labelled object queued for release.](https://lattix.io/images/blog/cross-domain-solutions-reference-cover.svg) Cross-Domain Solutions: A Practitioner Reference August 12, 2026 A cross-domain solution is an accredited controlled interface for accessing or transferring information between security domains of different classification. This reference covers the guard model, Raise the Bar, NCDSMO accreditation and the limits of both. Read More →](https://lattix.io/blog/cross-domain-solutions-reference/)

[![Lattix branded cover for the SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 analysis. Dark grid background, surgical yellow accent, IBM Plex Mono typography, July 14 2026 KEV addition and July 17 2026 federal deadline, CVSS 10.0 and CVSS 7.2 reference box, and a compromise-path strip where the object policy enforcement point is highlighted as the control that survives a gateway takeover.](https://lattix.io/images/blog/sonicwall-sma1000-cve-2026-15409-gateway-not-data-boundary-cover.svg) SonicWall SMA1000 Zero-Days Chain to Root. The Gateway Is Not the Data Boundary. July 21, 2026 CISA added SonicWall SMA1000 CVE-2026-15409 and CVE-2026-15410 to KEV on July 14, 2026. Chained, an unauthenticated SSRF and a root code injection hand an attacker the remote-access gateway. Object-level enforcement is what still refuses the reach it grants. Read More →](https://lattix.io/blog/sonicwall-sma1000-cve-2026-15409-gateway-not-data-boundary/)

[![Lattix branded cover for Check Point VPN CVE-2026-50751. /42 section number, June 2026 KEV disclosure date, CVSS 9.3 authentication-bypass statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the object-level policy enforcement point in a VPN-to-data flow strip.](https://lattix.io/images/blog/check-point-vpn-cve-2026-50751-concentrator-trust-boundary-cover.svg) Check Point VPN CVE-2026-50751 Is in KEV. The Concentrator Is Not the Trust Boundary. July 6, 2026 Check Point VPN CVE-2026-50751 is an actively exploited IKEv1 authentication bypass that grants an unauthenticated attacker a valid VPN session. CISA added it to KEV with a June 11, 2026 federal deadline. A VPN session is network reachability, not authority over data. Read More →](https://lattix.io/blog/check-point-vpn-cve-2026-50751-concentrator-trust-boundary/)

[![Lattix branded cover for PTC Windchill CVE-2026-12569. /43 section number, June 2026 KEV disclosure date, CVSS 9.3 unauthenticated-RCE statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the object-level policy enforcement point in a repository-to-data flow strip.](https://lattix.io/images/blog/ptc-windchill-cve-2026-12569-plm-repository-trust-boundary-cover.svg) PTC Windchill CVE-2026-12569 Is in KEV. The PLM Repository Is the Trust Boundary. July 6, 2026 PTC Windchill CVE-2026-12569 is an actively exploited, unauthenticated RCE that lets attackers drop web shells on the system holding a manufacturer's engineering IP. CISA added it to KEV with a June 28, 2026 deadline. When the repository is the trust boundary, the data has none. Read More →](https://lattix.io/blog/ptc-windchill-cve-2026-12569-plm-repository-trust-boundary/)

[![Lattix branded cover for HHS HC3 Q2 2026 Threat Brief. /32 section number, Q2 2026 threat brief publish window, healthcare-targeted intrusion count statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the architectural response pillar in a threat actor strip.](https://lattix.io/images/blog/hhs-hc3-healthcare-q2-2026-data-centric-threat-response-cover.svg) HHS HC3 Q2 2026 Threat Brief: Healthcare Data Is the Target. The Response Is Architectural. July 2, 2026 HHS HC3 quarterly threat briefs catalog the threat actor groups and tactics targeting healthcare data through Q2 2026. The pattern across Medtronic, Change Healthcare aftermath, and recent intrusions is consistent. Healthcare data is high-value and weakly bound to enforcement. Read More →](https://lattix.io/blog/hhs-hc3-healthcare-q2-2026-data-centric-threat-response/)

[![Lattix branded cover for the Oracle PeopleSoft CVE-2026-35273 analysis. /41 section number, IBM Plex Mono on a dark grid background, the unauthenticated Environment Management flaw named, a CVSS 9.8 statistic, a 68 percent higher-education victim share, and an exploit-to-data strip with the object-level enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/oracle-peoplesoft-cve-2026-35273-unauth-rce-data-layer-cover.svg) Oracle PeopleSoft CVE-2026-35273: Unauthenticated Access Reaches Data the Identity Layer Never Sees July 2, 2026 ShinyHunters exploited an unauthenticated PeopleSoft flaw as a zero-day for two weeks before Oracle's advisory. Universities took 68 percent of the hits. No credential was stolen and none was needed. The data carried no policy of its own. Read More →](https://lattix.io/blog/oracle-peoplesoft-cve-2026-35273-unauth-rce-data-layer/)

[![Lattix branded cover for the OWASP Top 10 for Agentic Applications 2026. /44 section number, IBM Plex Mono typography on a dark grid background, surgical yellow accent on the object-level policy enforcement point, ASI03 identity abuse and ASI06 memory poisoning callouts, LATTIX wordmark and lattix.io footer.](https://lattix.io/images/blog/owasp-agentic-ai-top-10-data-layer-cover.svg) OWASP Agentic Top 10: Memory Poisoning and Identity Abuse Are Data-Layer Risks July 2, 2026 OWASP's Top 10 for Agentic Applications 2026 names memory poisoning, identity abuse, and tool misuse among the top agentic risks. Several entries reduce to ungoverned data access, and object-level cryptographic enforcement is the control the taxonomy implies but does not name. Read More →](https://lattix.io/blog/owasp-agentic-ai-top-10-data-layer/)

[![Lattix branded cover for the mid-year 2026 breach pattern analysis. /27 section number, IBM Plex Mono on dark grid background, the identity-to-data pivot named across six 2026 incidents, a 4.67 million dollar credential-breach statistic, and a pivot strip with the data-layer enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/mid-year-2026-breach-pattern-identity-to-data-pivot-cover.svg) The Mid-Year 2026 Breach Pattern: Identity Holds, Data Does Not June 30, 2026 Six 2026 breaches, from Mercor to the Canvas and Medtronic disclosures, trace one pattern. Identity and network controls evaluate correctly. The compromised principal reads data the credential is authorized to reach. The data carries no policy of its own. Read More →](https://lattix.io/blog/mid-year-2026-breach-pattern-identity-to-data-pivot/)

[![Lattix branded cover for Federal Cloud Migration ATO Acceleration Lives at the Data Layer. /31 section number, ATO control family pace comparison, IBM Plex Mono on dark grid background, yellow accent on the data-control families that consistently bottleneck ATO timelines.](https://lattix.io/images/blog/federal-cloud-migration-ato-acceleration-data-layer-cover.svg) Federal Cloud Migration ATO Acceleration Lives at the Data Layer June 26, 2026 ATO timelines for federal cloud workloads consistently exceed the planned program schedule. Boundary, identity, and configuration controls converge quickly. Data controls do not. The architecture that produces ATO evidence by construction is the architecture that compresses the cycle. Read More →](https://lattix.io/blog/federal-cloud-migration-ato-acceleration-data-layer/)

[![Lattix branded cover for Defense Industrial Base Audit Failure Patterns. /31 section number, 110 NIST 800-171 practices statistic, three recurring NOT MET findings highlighted, IBM Plex Mono on dark grid background, surgical yellow accent on the architectural pattern in a practice family strip.](https://lattix.io/images/blog/dib-cyber-compliance-audit-failure-patterns-data-controls-cover.svg) Defense Industrial Base Audit Failure Patterns Point to the Same Data Controls June 25, 2026 CMMC Phase 1 assessment data, DCMA audit findings, and GAO supply chain reports converge on the same NOT MET controls. SC.L2-3.13.11 on cryptographic protection. MP.L2-3.8.9 on backup encryption. AC.L2-3.1.20 on external information system flows. The pattern is architectural. Read More →](https://lattix.io/blog/dib-cyber-compliance-audit-failure-patterns-data-controls/)

[![Lattix branded cover for CISA Secure by Design AI Pledge One Year In. /30 section number, 2024 pledge launch date, signatory commitment categories statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the evidence pillar in a pledge commitment strip.](https://lattix.io/images/blog/cisa-secure-by-design-ai-pledge-one-year-evidence-cover.svg) CISA Secure by Design AI Pledge: A Year In, Evidence Is What Is Missing June 23, 2026 The CISA Secure by Design AI pledge launched in 2024 with broad industry signatories. A year later, evidence supporting the pledge commitments remains uneven. Data provenance, training-set lineage, and access governance over model outputs are the evidence categories vendors cannot produce. Read More →](https://lattix.io/blog/cisa-secure-by-design-ai-pledge-one-year-evidence/)

[![Lattix branded cover for Chromium V8 CVE-2026-11645. /39 section number, June 2026 KEV disclosure date, CVSS 8.8 out-of-bounds renderer statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the object-level PEP in a browser-to-data flow strip.](https://lattix.io/images/blog/chromium-v8-cve-2026-11645-kev-browser-data-surface-cover.svg) Chromium V8 CVE-2026-11645 Is in KEV. The Browser Is an Endpoint Data Surface. June 22, 2026 Chromium V8 CVE-2026-11645 is an actively exploited out-of-bounds flaw giving an attacker read and write access inside the renderer. CISA added it to KEV with a June 23, 2026 federal deadline. The browser is where enterprise data is read, and the renderer holds the cleartext. Read More →](https://lattix.io/blog/chromium-v8-cve-2026-11645-kev-browser-data-surface/)

[![Lattix branded cover for Microsoft Purview Sensitivity Labels and ZTDF Diverge When the Label Stops Carrying Policy. /30 section number, label metadata versus policy-bound object comparison, IBM Plex Mono on dark grid background, yellow accent on the boundary where Purview enforcement ends and ZTDF enforcement persists.](https://lattix.io/images/blog/microsoft-purview-sensitivity-labels-ztdf-policy-divergence-cover.svg) Microsoft Purview Sensitivity Labels and ZTDF Diverge When the Label Stops Carrying Policy June 22, 2026 Microsoft Purview sensitivity labels travel with files and provide a useful classification overlay. The label is metadata; the policy lives in the Purview service. ZTDF binds policy to the object cryptographically. Compare what survives a cross-tenant transfer in each model. Read More →](https://lattix.io/blog/microsoft-purview-sensitivity-labels-ztdf-policy-divergence/)

[![Lattix branded cover for Arista EOS CVE-2026-7473. /40 section number, June 2026 KEV disclosure date, CVSS 6.9 no-patch statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the object-level PEP in a network-fabric-to-data flow strip.](https://lattix.io/images/blog/arista-eos-cve-2026-7473-tunnel-decap-data-layer-cover.svg) Arista EOS CVE-2026-7473 Forwards Untrusted Tunnel Traffic. The Fabric Is Not the Boundary. June 19, 2026 Arista EOS CVE-2026-7473 is an actively exploited tunnel decapsulation flaw that makes a switch forward attacker traffic into isolated segments. CISA added it to KEV with a June 23, 2026 federal deadline, and Arista will not patch it. Read More →](https://lattix.io/blog/arista-eos-cve-2026-7473-tunnel-decap-data-layer/)

[![Lattix branded cover for JADC2 Cross-Domain Data Sharing Requires a Data-Centric Substrate. /29 section number, JADC2 milestone date, four cross-domain release patterns statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the policy enforcement point in a multi-domain release strip.](https://lattix.io/images/blog/jadc2-cross-domain-data-sharing-zero-trust-architecture-cover.svg) JADC2 Cross-Domain Data Sharing Requires a Data-Centric Substrate June 18, 2026 DoD JADC2 and CJADC2 milestones depend on cross-domain release of mission data at operational tempo. Guard-appliance cross-domain solutions do not scale to that tempo. ABAC at the policy enforcement point over ZTDF-formatted objects is the substrate that does. Read More →](https://lattix.io/blog/jadc2-cross-domain-data-sharing-zero-trust-architecture/)

[![Lattix branded cover for DORA Pushes Operational Resilience Past the Contract. /28 section number, January 17 2025 effective date, five DORA pillar statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the technical evidence pillar in a regulatory pillar strip.](https://lattix.io/images/blog/dora-third-country-ict-provider-data-control-evidence-cover.svg) DORA Pushes Operational Resilience Past the Contract. ICT Provider Evidence Is Technical. June 16, 2026 EU DORA effective January 17 2025 reaches ICT third-party providers including non-EU vendors serving EU financial entities. Tier 1 supervisory examinations are ramping in 2026. Contract clauses do not satisfy DORA's evidence expectations. Technical evidence for data-level control does. Read More →](https://lattix.io/blog/dora-third-country-ict-provider-data-control-evidence/)

[![Lattix branded cover for SolarWinds Serv-U CVE-2026-28318. /38 section number, June 2026 KEV disclosure date, 12,000+ exposed-hosts statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the object-level PEP in a transfer-to-data flow strip.](https://lattix.io/images/blog/solarwinds-serv-u-cve-2026-28318-file-transfer-trust-boundary-cover.svg) SolarWinds Serv-U CVE-2026-28318 Is in KEV. The File Transfer Appliance Is the Trust Boundary. June 13, 2026 SolarWinds Serv-U CVE-2026-28318 is an actively exploited, unauthenticated flaw that crashes the file transfer service. CISA added it to KEV with a June 19, 2026 federal deadline. Managed file transfer keeps proving the appliance is a transport, not a trust boundary. Read More →](https://lattix.io/blog/solarwinds-serv-u-cve-2026-28318-file-transfer-trust-boundary/)

[![Lattix branded cover for NIST AI 600-1 GenAI Profile Maps Cleanly to Data-Centric Controls. /28 section number, GAI risk-to-control mapping table, IBM Plex Mono on dark grid background, yellow accent on the data-pillar controls that satisfy multiple GAI risk categories from one primitive.](https://lattix.io/images/blog/nist-ai-600-1-genai-profile-data-centric-controls-cover.svg) NIST AI 600-1 GenAI Profile Maps Cleanly to Data-Centric Controls June 12, 2026 NIST AI 600-1 names the unique risks of foundation models. The mitigations the profile recommends, training data provenance, output attribution, access governance over model artifacts, are evidence categories that process attestation cannot supply. Data-centric architecture supplies them by construction. Read More →](https://lattix.io/blog/nist-ai-600-1-genai-profile-data-centric-controls/)

[![Lattix branded cover for Microsoft Defender CVE-2026-41091 Escalates to SYSTEM. /37 section number, May 2026 zero-day disclosure date, CVSS 7.8 local-to-SYSTEM statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the data-layer PEP in a host-to-data flow strip.](https://lattix.io/images/blog/microsoft-defender-cve-2026-41091-endpoint-control-attack-surface-cover.svg) Microsoft Defender CVE-2026-41091 Escalates to SYSTEM. The Endpoint Control Is the Attack Surface. June 11, 2026 Microsoft Defender CVE-2026-41091 is an actively exploited link-following flaw that elevates a local user to SYSTEM. CISA added it to KEV with a June 3, 2026 federal deadline. When the security tool is the escalation path, object-level enforcement is what survives. Read More →](https://lattix.io/blog/microsoft-defender-cve-2026-41091-endpoint-control-attack-surface/)

[![Lattix branded cover for PCI DSS 4.0.1 Requires Cryptographic Agility. /27 section number, March 2025 binding date, twelve future-dated requirements statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the PCI requirement in a control flow strip.](https://lattix.io/images/blog/pci-dss-4-0-1-cryptographic-agility-cardholder-data-cover.svg) PCI DSS 4.0.1 Requires Cryptographic Agility. Cardholder Data Architectures Have to Move. June 11, 2026 PCI DSS 4.0.1 effective April 2024 introduced future-dated cryptographic requirements that bite in 2025 and 2026. Cardholder Data Environments tightly coupling crypto to application code cannot migrate inside the PCI assessment window. Data-centric encryption is the architectural path. Read More →](https://lattix.io/blog/pci-dss-4-0-1-cryptographic-agility-cardholder-data/)

[![Lattix branded cover for Cross-Domain Solutions Modernize From Guard Appliances to Object-Level Release. /27 section number, twenty-year guard lineage to ZTDF/IC-TDF object-level release, IBM Plex Mono on dark grid background, yellow accent on the object-level release decision point.](https://lattix.io/images/blog/cross-domain-solutions-guard-appliances-object-level-release-cover.svg) Cross-Domain Solutions Modernize From Guard Appliances to Object-Level Release June 8, 2026 Guard appliances have served twenty years of joint and coalition cross-domain release. They evaluate data at the boundary. NSA Phase Two cites ZTDF and IC-TDF as schemas that move release evaluation to the object itself, at cryptographic speed. Read More →](https://lattix.io/blog/cross-domain-solutions-guard-appliances-object-level-release/)

[![Lattix branded cover for AI Agents Form Credential Delegation Chains. /25 section number, agent-to-agent delegation hops metric, IBM Plex Mono on dark grid background, surgical yellow accent on the policy enforcement point in a multi-hop chain strip.](https://lattix.io/images/blog/ai-agent-credential-delegation-chains-policy-bound-tokens-cover.svg) AI Agents Form Credential Delegation Chains. Static Tokens Cannot Hold. June 4, 2026 Autonomous agent workflows now span multiple hops, multiple vendors, and multiple identity domains. A bearer token at any hop is the failure point. Treating each delegated credential as a policy-bound data object closes the chain. The architecture is procurable today. Read More →](https://lattix.io/blog/ai-agent-credential-delegation-chains-policy-bound-tokens/)

[![Lattix branded cover for CMMC Level 2 Compliance Through Data-Centric Security. /11 section number, 110 practices and 14 domains metadata, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/cmmc-level-2-compliance-data-centric-security-cover.svg) CMMC Level 2 Compliance Through Data-Centric Security June 4, 2026 CMMC Level 2 requires 110 practices across 14 domains. Data-centric security maps to 76 of them through a single architectural primitive bound to the CUI object. Read More →](https://lattix.io/blog/cmmc-level-2-compliance-data-centric-security/)

[Lattix Anthropic's Zero Trust for AI Agents Framework Reaches the Data Layer at the Optimized Tier June 2, 2026 Anthropic published a Zero Trust framework for autonomous AI agents on May 27, 2026. The framework names the right architecture for the agent threat model. The Optimized tier reaches the data layer. Data-centric enforcement is how organizations get there. Read More →](https://lattix.io/blog/anthropic-zero-trust-ai-agents-framework-data-layer-optimized-tier/)

[![Lattix branded cover for Cisco SD-WAN CVE-2026-20182 Bypasses the Network Controller. /24 section number, May 2026 zero-day disclosure date, unauthenticated admin bypass statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the data-layer boundary in a controller-to-data flow strip.](https://lattix.io/images/blog/cisco-sd-wan-cve-2026-20182-data-layer-isolation-cover.svg) Cisco SD-WAN CVE-2026-20182 Bypasses the Network Controller. The Data Layer Holds. June 2, 2026 Cisco confirmed CVE-2026-20182 against Catalyst SD-WAN Controller as exploited in the wild in May 2026. Unauthenticated attackers gain admin on affected systems. CISA added the flaw to KEV. SD-WAN is the East-West choke point that perimeter zero trust depends on. Data-level enforcement does not. Read More →](https://lattix.io/blog/cisco-sd-wan-cve-2026-20182-data-layer-isolation/)

[![Lattix branded cover for The Linux Copy Fail CVE-2026-31431 Reaches Root. /23 section number, May 1 2026 KEV add date, 732-byte exploit statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the data-layer boundary in a kernel-to-data flow strip.](https://lattix.io/images/blog/linux-copy-fail-cve-2026-31431-kev-data-layer-cover.svg) The Linux Copy Fail CVE-2026-31431 Reaches Root. Object-Level Enforcement Reaches the Data. May 28, 2026 CVE-2026-31431 escalates an unprivileged Linux user to root with a 732-byte Python script. CISA added it to KEV May 1 with a federal remediation deadline of May 15. Patching closes the vector. Object-level cryptographic enforcement closes the consequence. Read More →](https://lattix.io/blog/linux-copy-fail-cve-2026-31431-kev-data-layer/)

[![Lattix branded cover for The Nx Console Supply Chain Attack Is a Credentials-as-Data Story. /22 section number, May 18 2026 incident timestamp, 3,800 GitHub internal repositories statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the policy enforcement point in a credential release flow strip.](https://lattix.io/images/blog/nx-console-supply-chain-credentials-as-data-cover.svg) The Nx Console Supply Chain Attack Is a Credentials-as-Data Story May 22, 2026 On May 18, 2026, a compromised Nx Console VS Code extension exfiltrated credentials from developer workstations. By May 19, GitHub disclosed that 3,800 internal repositories had been exfiltrated as a result. The pivot was static credentials. The architectural answer is to treat credentials as policy-bound data. Read More →](https://lattix.io/blog/nx-console-supply-chain-credentials-as-data/)

[![Lattix branded cover for Data Classification: The Foundation You Can't Skip. /09 section number, classification taxonomy metadata, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-classification-foundation-zero-trust-cover.svg) Data Classification: The Foundation You Can't Skip May 21, 2026 You cannot enforce a policy you have not defined, and you cannot define a policy on data you have not classified. Classification is where zero trust actually begins. Read More →](https://lattix.io/blog/data-classification-foundation-zero-trust/)

[![Lattix branded cover for CMMC Phase 2 Starts November 10. /16 section number, 110 practice count and November 10 2026 deadline metadata, IBM Plex Mono on dark grid background, surgical yellow accent on the Level 2 step in a four-phase rollout strip.](https://lattix.io/images/blog/cmmc-phase-2-november-2026-c3pao-level-2-cover.svg) CMMC Phase 2 Is Suspended. The Level 2 Data Requirements Still Bind. May 15, 2026 CMMC Phase 2 was suspended in July 2026 and there is no November 10 enforcement date. The third-party C3PAO gate is paused, but DFARS 252.204-7012 and 7020 still bind, Phase 1 self-assessment with SPRS submission still applies, and the 110 NIST SP 800-171 Rev 2 practices still govern what Level 2 requires. Read More →](https://lattix.io/blog/cmmc-phase-2-november-2026-c3pao-level-2/)

[![Lattix branded cover for The EU AI Act High-Risk Deadline Slipped to December 2027. /20 section number, December 2027 deadline metadata, Articles 9 through 17 plus 26 statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the data governance node in an Articles map strip.](https://lattix.io/images/blog/eu-ai-act-high-risk-data-governance-conformity-evidence-cover.svg) The EU AI Act High-Risk Deadline Slipped to December 2027. The Architecture Window Did Not. May 15, 2026 The May 7, 2026 political agreement pushed the EU AI Act Article 6 deadline from August 2026 to December 2027. The substantive obligations under Articles 10, 12, and 14 did not change. The architecture that produces conformity evidence takes twelve to eighteen months to build. Read More →](https://lattix.io/blog/eu-ai-act-high-risk-data-governance-conformity-evidence/)

[![Lattix branded cover for The HIPAA Security Rule NPRM Demands Cryptographic Safeguards the Current Rule Only Implies. /21 section number, December 2024 NPRM date and 4,700 comments statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the encryption requirement node in a safeguard map strip.](https://lattix.io/images/blog/hipaa-security-rule-nprm-cryptographic-safeguards-cover.svg) The HIPAA Security Rule NPRM Demands Cryptographic Safeguards the Current Rule Only Implies May 15, 2026 HHS issued the first major HIPAA Security Rule update since 2003 in December 2024. OCR targets May 2026 for the final rule, with 4,700 comments under review. The NPRM raises the bar on encryption, MFA, inventory, and audit. The architecture window is shorter. Read More →](https://lattix.io/blog/hipaa-security-rule-nprm-cryptographic-safeguards/)

[![Lattix branded cover for The Medtronic Breach Is the Canvas Playbook Run Against a Medical Device Maker. /12 section number, 9M records statistic, ShinyHunters extortion timeline, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/medtronic-shinyhunters-breach-healthcare-data-enforcement-cover.svg) The Medtronic Breach Is the Canvas Playbook Run Against a Medical Device Maker May 12, 2026 Medtronic confirmed a ShinyHunters extortion event in an SEC 8-K on April 24, 2026. Nine million records claimed, the leak site listing pulled before the deadline. The architectural lesson is the same one the Canvas breach already wrote: containment closes the access path, not the copies that already left. Read More →](https://lattix.io/blog/medtronic-shinyhunters-breach-healthcare-data-enforcement/)

[![Lattix branded cover for NIST's Critical Infrastructure AI RMF Profile Turns Trustworthy AI Into System Requirements. /16 section number, AI RMF four function diagram, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/nist-critical-infrastructure-ai-rmf-profile-system-requirements-cover.svg) NIST's Critical Infrastructure AI RMF Profile Turns Trustworthy AI Into System Requirements May 12, 2026 NIST published the concept note for a Trustworthy AI in Critical Infrastructure Profile on April 7, 2026. The profile turns the AI RMF Govern, Map, Measure, Manage functions into system requirements for energy, water, and transportation operators. Data provenance and lineage map directly to the profile controls. Read More →](https://lattix.io/blog/nist-critical-infrastructure-ai-rmf-profile-system-requirements/)

[![Lattix branded cover for NSA Phase Two Cites ZTDF and IC-TDF as DRM Examples. Procurement Catches Up Next. /13 section number, ZIG Phase Two metadata, Data Rights Management schema callout, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/nsa-ztdf-interoperability-standard-phase-two-cover.svg) NSA Phase Two Cites ZTDF and IC-TDF as DRM Examples. Procurement Catches Up Next. May 12, 2026 NSA's Zero Trust Implementation Guideline Phase Two, released January 30, 2026, tells participating components to standardize a data rights management schema and cites ZTDF and IC-TDF as the examples. A recommendation, not a mandate, and enough to write a requirement against. Read More →](https://lattix.io/blog/nsa-ztdf-interoperability-standard-phase-two/)

[![Lattix branded cover for Why Network Zero Trust Stops at the Data Boundary. /14 section number, five pillar maturity map showing data pillar gap, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/why-network-zero-trust-stops-at-data-boundary-cover.svg) Why Network Zero Trust Stops at the Data Boundary May 12, 2026 NIST SP 800-207 and the CISA Zero Trust Maturity Model define five pillars. Most enterprise programs stop at networks. The data pillar requires cryptographic enforcement bound to the object, not perimeter or session controls, and the gap is architectural rather than budgetary. Read More →](https://lattix.io/blog/why-network-zero-trust-stops-at-data-boundary/)

[![Lattix branded cover for Coalition Data Sharing. /06 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/classified-data-sharing-coalition-partners-cover.svg) Coalition Data Sharing Without Infrastructure Agreement May 8, 2026 When allied partners operate separate networks and classification systems, data-centric security moves enforcement from infrastructure to the data itself. Read More →](https://lattix.io/blog/classified-data-sharing-coalition-partners/)

[![Lattix branded cover for Confidential Computing and Data-Centric Zero Trust. /07 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/confidential-computing-meets-data-centric-security-cover.svg) Confidential Computing and Data-Centric Zero Trust: Composable Protection May 8, 2026 Trusted execution environments protect data in use. Zero trust data fabrics protect it at rest and in transit. Together, they create architectural closure across all three states. Read More →](https://lattix.io/blog/confidential-computing-meets-data-centric-security/)

[![Lattix branded cover for M&A data rooms and policy-bound due diligence. /08 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-rooms-mergers-acquisitions-due-diligence-cover.svg) M&A Data Rooms After Deal Close: Policy-Bound Due Diligence May 8, 2026 Virtual data rooms protect documents while deals are live. The hard question: what happens after the deal closes or collapses? Policy-bound data with cryptographic enforcement ensures revocation is real. Read More →](https://lattix.io/blog/data-rooms-mergers-acquisitions-due-diligence/)

[![Lattix branded cover for HIPAA enforcement beyond BAAs. /12 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/healthcare-hipaa-beyond-business-associate-agreements-cover.svg) HIPAA Security Rule Enforcement Starts With Data, Not Paper May 8, 2026 Business Associate Agreements transfer liability, not enforcement. HIPAA's Security Rule is explicit about what must be protected and how. Real compliance means cryptographic policy at the PHI object. Read More →](https://lattix.io/blog/healthcare-hipaa-beyond-business-associate-agreements/)

[![Lattix branded cover for the Canvas breach analysis. /05 section number, IBM Plex Mono on dark grid background, surgical yellow accent, 275M record stat panel and FERPA enforcement gap reference.](https://lattix.io/images/blog/instructure-canvas-breach-data-enforcement-cover.svg) The Canvas Breach Is a Data Enforcement Story, Not a Containment Story May 8, 2026 ShinyHunters claimed 275 million records from Instructure across 9,000 institutions. Containment closed the access path. The records had already crossed the policy boundary. The disclosure surface is what FERPA, schools, and downstream subjects have to deal with now. Read More →](https://lattix.io/blog/instructure-canvas-breach-data-enforcement/)

[![Lattix branded cover for key management in data-centric security. /13 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/key-management-data-centric-security-cover.svg) Key Management in Data-Centric Security: Who Holds the Keys May 8, 2026 A wrapped data object is only as secure as the policy authority that releases the key. Key management is where data-centric security becomes operational reality. Read More →](https://lattix.io/blog/key-management-data-centric-security/)

[![Lattix branded cover for data-centric security ROI. /14 SECURITY ECONOMICS · BOARD. IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/measuring-security-roi-data-centric-board-presentation-cover.svg) Translating Data-Centric Security Into Board Language May 8, 2026 Boards fund security investments they can measure. Data-centric architecture produces three measurable outcomes: faster authorization, lower third-party overhead, reduced breach liability. Read More →](https://lattix.io/blog/measuring-security-roi-data-centric-board-presentation/)

[![Lattix branded cover for secure file transfer. /15 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/secure-file-transfer-age-of-zero-trust-cover.svg) Secure File Transfer in the Age of Zero Trust May 8, 2026 Every managed file transfer product trusts the endpoint. Recent MFT breaches proved that trust fails at scale. Zero Trust requires the file itself to carry its own security policy. Read More →](https://lattix.io/blog/secure-file-transfer-age-of-zero-trust/)

[![Lattix branded cover for SBOM to provenance supply chain security. /17 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/software-supply-chain-sbom-to-signed-provenance-cover.svg) SBOM to Provenance: Verifiable Supply Chains on Immutable Ledgers May 8, 2026 SBOMs inventory what is in the box. Signed provenance anchored to an immutable ledger proves the box was assembled as claimed. A walkthrough of SLSA, Sigstore, and why transparency logs matter. Read More →](https://lattix.io/blog/software-supply-chain-sbom-to-signed-provenance/)

[![Lattix branded cover: Data-Centric Security Closes the Third-Party Risk Assurance Gap. /18 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/third-party-risk-data-centric-answer-cover.svg) Data-Centric Security Closes the Third-Party Risk Assurance Gap May 8, 2026 Questionnaire fatigue and point-in-time audits cannot track vendor risk continuously. Policy authority retained at the data layer does. Read More →](https://lattix.io/blog/third-party-risk-data-centric-answer/)

[![Lattix branded cover for Trusted Data Format evolution from IC origins to ZTDF. /19 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/trusted-data-format-origin-evolution-future-cover.svg) Trusted Data Format: From IC Origin to ZTDF Standard May 8, 2026 The Trusted Data Format began in the intelligence community as a solution to cross-domain data sharing. Its evolution reflects the shift from network-centric to data-centric security. Read More →](https://lattix.io/blog/trusted-data-format-origin-evolution-future/)

[![Lattix branded cover for ABAC vs RBAC. /08 section number, ABAC and RBAC contrast metadata, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/abac-vs-rbac-zero-trust-default-cover.svg) ABAC vs RBAC: Why Attribute-Based Access Control Is the Zero Trust Default May 7, 2026 Role-based access grants standing privileges that outlive their purpose. Attribute-based access evaluates every request in context. For zero trust, only one of these actually works. Read More →](https://lattix.io/blog/abac-vs-rbac-zero-trust-default/)

[![Lattix branded cover for Post-Quantum Cryptography: Why the Transition Has to Happen Now. /03 section number, FIPS 140-2 sunset date, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/post-quantum-cryptography-why-transition-now-cover.svg) Post-Quantum Cryptography: Why the Transition Has to Happen Now May 4, 2026 Two PQC deadlines are already running. September 21, 2026 sunsets FIPS 140-2 for federal procurement. January 2027 binds CNSA 2.0 for National Security Systems. The migration that matters is not the algorithm. It is the cryptographic agility to swap one. Read More →](https://lattix.io/blog/post-quantum-cryptography-why-transition-now/)

[![Lattix diagram showing an MCP-connected AI agent with injected prompts denied at policy enforcement points, ABAC-compliant accesses allowed with ML-KEM-768 unwrap, and every decision committed to a Merkle-tree lineage.](https://lattix.io/images/blog/mcp-blast-radius-cryptographic-data-enforcement-cover.svg) How Cryptographic Data Enforcement Contains the MCP Blast Radius April 24, 2026 AI agents acting on injected instructions are now the dominant exfiltration vector. Two April 2026 incidents show why ABAC enforcement at the data object, not the network or the identity plane, is the control that actually contains MCP. Read More →](https://lattix.io/blog/mcp-blast-radius-cryptographic-data-enforcement/)

[![Diagram showing the disclosure surface around a patched SharePoint instance: the patch closes the network vector while the pre-patch read and write events remain cryptographically unaccounted for without data-layer enforcement.](https://lattix.io/images/blog/sharepoint-disclosure-surface-diagram.svg) SharePoint CVE-2026-32201 Is in KEV. The Disclosure Surface Is the Real Issue. April 22, 2026 CISA added the April SharePoint spoofing zero-day to KEV on April 14 with an FCEB remediation deadline of April 28. Patching closes the vector. It does not answer what an attacker read, modified, or signed before the update landed. Read More →](https://lattix.io/blog/sharepoint-cve-2026-32201-kev-disclosure-surface/)

[![Lattix branded cover for Protecting Sensitive AI Training Data with Data-Centric Security. /06 section number, infrastructure-to-data protection shift metadata, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/protecting-sensitive-ai-training-data-with-data-centric-security-cover.svg) Protecting Sensitive AI Training Data with Data-Centric Security May 13, 2025 AI systems are only as trustworthy as the data they train on. A data-centric security approach shifts protection from infrastructure to the data itself. Read More →](https://lattix.io/blog/protecting-sensitive-ai-training-data-with-data-centric-security/)

[![Lattix branded cover for How Blockchain Enhances Cybersecurity in the Era of Digital Threats. /01 section number, tamper-evident audit trail metadata, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/blockchain-for-cybersecurity-cover.svg) How Blockchain Enhances Cybersecurity in the Era of Digital Threats April 29, 2025 Blockchain technology offers unique capabilities for cybersecurity: tamper-proof audit trails, smart contracts for access control, and decentralized identity management. Read More →](https://lattix.io/blog/blockchain-for-cybersecurity/)

[![Lattix branded cover for Can You Trust AI? Not Without Securing the Data It Trains On. /02 section number, training-data integrity metadata, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/can-you-trust-ai-not-without-securing-the-data-it-trains-on-cover.svg) Can You Trust AI? Not Without Securing the Data It Trains On April 15, 2025 AI trustworthiness depends entirely on training data integrity. Without securing the data pipeline, AI outputs cannot be trusted. Read More →](https://lattix.io/blog/can-you-trust-ai-not-without-securing-the-data-it-trains-on/)

[![Lattix branded cover for What is Zero Trust Data Format (ZTDF) and Why Does It Matter? /08 section number, embedded-control self-enforcing metadata, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/what-is-zero-trust-data-format-and-why-does-it-matter-cover.svg) What is Zero Trust Data Format (ZTDF) and Why Does It Matter? February 9, 2025 ZTDF creates a self-enforcing security boundary around every data object with embedded encryption, access policies, and audit capabilities. Read More →](https://lattix.io/blog/what-is-zero-trust-data-format-and-why-does-it-matter/)

[![Lattix branded cover for Why Zero Trust is the Future of Data Security. /09 section number, verify-always trust-model metadata, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/why-zero-trust-is-the-future-of-data-security-cover.svg) Why Zero Trust is the Future of Data Security February 9, 2025 Traditional perimeter-based security is failing. Zero Trust architecture operates on a simple principle: never trust, always verify. Read More →](https://lattix.io/blog/why-zero-trust-is-the-future-of-data-security/)

## Related topics

- [Zero Trust Architecture](https://lattix.io/blog/topics/zero-trust/)
- [Zero Trust Data Format](https://lattix.io/blog/topics/ztdf/)
- [Access Control](https://lattix.io/blog/topics/access-control/)
- [AI Security](https://lattix.io/blog/topics/ai-security/)
- [Post-Quantum Cryptography](https://lattix.io/blog/topics/post-quantum-cryptography/)
- [Cryptography and Key Management](https://lattix.io/blog/topics/cryptography/)

[All topics →](https://lattix.io/blog/topics/)