Thales launches tool to secure sensitive data from AI

Thales has launched CipherTrust Data Security Posture Management, aimed at organisations managing exposure of sensitive data as AI use expands.

The platform is designed to go beyond identifying exposed data by linking risk analysis with data protection in a single service. It combines data discovery and classification with information on access, activity and behaviour, then lets security teams apply encryption, masking or tokenisation to data judged to be at risk.

Data Security Posture Management tools have become a growing part of the cybersecurity market as companies try to map where sensitive data sits across cloud services, on-premises systems, software-as-a-service applications and third-party environments. Thales is positioning its offering around a broader concern: AI assistants, applications and autonomous agents are gaining access to corporate information faster than many governance processes can adapt.

That shift has increased the need to understand not only where information is stored, but also who or what can access it, how it is being used and which weaknesses pose the greatest risk. The platform is intended to help security teams act without moving between separate discovery, analysis and protection tools.

AI pressure

AI is adding complexity to data security as information spreads across more repositories and workflows. As businesses connect internal data to copilots, automated systems and analytics tools, security teams are being pushed to assess access rights, suspicious behaviour and data sensitivity at the same time.

According to Thales, CipherTrust DSPM uses AI-driven behavioural analytics to identify unusual access and activity. Those signals can be correlated into attack chains to help teams investigate threats more quickly, including potential insider risk. The platform also provides remediation guidance and supports action on some access-control issues.

A notable element of the launch is Thales' effort to distinguish its product from DSPM tools focused mainly on visibility and access remediation. Many existing approaches stop at discovery or recommendations to tighten permissions. By contrast, Thales says its platform lets users protect the data itself through controls such as encryption, masking and tokenisation within the same environment.

That approach reflects a longstanding security debate over whether organisations should rely mainly on restricting access to sensitive data or place more emphasis on making the data less usable if exposed. In practice, many enterprises do both, but often through different products and teams. Thales argues that tighter integration could shorten response times when exposure is found.

Broad coverage

Thales says the service covers both structured and unstructured data across cloud, on-premises and hybrid environments. That matters because many businesses now store customer, employee and operational information across databases, file stores, collaboration tools and analytics platforms rather than in a small number of centralised systems.

The launch also builds on areas where Thales already has an established presence, including encryption, key management, access control and activity monitoring. The company says the new platform draws on more than 30 years of work in data discovery and protection.

For Thales, the move adds to a broader cybersecurity portfolio at a time when large industrial and defence technology groups are seeking more recurring software and services revenue. The company operates across defence, aerospace and cyber markets, and reported annual sales of €22.1 billion in 2025. It has more than 85,000 employees in 65 countries and spends €4.5 billion a year on research and development.

The launch also comes as regulators and customers ask for stronger controls over how AI systems access and process sensitive information. That pressure is likely to increase demand for tools that can show what data AI models and software agents can reach, and whether those access paths create security or compliance problems.

In a statement on the launch, Todd Moore outlined Thales' view of the market. "Organisations don't need another security tool that simply gives them a longer list of problems to investigate," said Todd Moore, Vice President of Data Security Products, Thales.

Moore added: "They need to understand which sensitive data is truly at risk and take direct action to reduce it. While traditional DSPM remediation often focuses on restricting who can access data, CipherTrust DSPM goes further by connecting risks to protections such as encryption and tokenization, helping protect the data itself, rather than relying on permissions alone."

Tokyo Electron Device, which works with enterprise customers on cybersecurity deployments, also commented on the product. "Tokyo Electron Device works with enterprises to address increasingly complex cybersecurity challenges as these organizations connect AI tools and agents to more of their business data. CipherTrust DSPM's ease of deployment and the accuracy of its data classification enables us to help customers quickly gain understanding of where their sensitive data is, who or what can access it, how to protect it, and without slowing AI adoption. These capabilities provide significant value to customers looking to embrace AI while maintaining control of their most sensitive information," said Hiroji Sugito, Principal Data Security Engineer, Tokyo Electron Device.