Sensitive Data and AI: Protecting Privacy Without Losing Context

Sensitive data is a small share of what enterprises want to feed AI, but it carries most of the risk. Sam Sternberg, Global Head of Solutions at Skyflow, argued at the ALIGN AI Executive Summit New York City 2026 on June 25 that protecting that data at runtime, rather than stripping it out, is how AI projects get past compliance and into production. The session, From Risk to Reward: Building AI Innovation on a Foundation of Data Privacy & Security, was sponsored by Skyflow.

Why do AI projects stall before production?

Data privacy was already one of the hardest problems in the enterprise before generative AI, Sternberg said, with privacy reviews required before products could use customer data. Since then, he said, privacy rules have spread across U.S. states and countries, agents have learned to code, call functions and act on data autonomously, and AI tools can reach company knowledge at the click of a button.

In his consulting days, he saw programs stop just short of production. With AI, the friction isn't compute or engineering talent. "Governance frameworks that mitigate operational and legal risks are what is missing today," he said. The problem is preparing the company context that AI needs to deliver value.

He noted that OWASP's list of generative AI risks ranks sensitive data leakage first, because the most sensitive data is often the most useful to AI.

What makes AI data security different?

"Sensitive data is usually less than one percent of the contextual data" passed to AI, Sternberg said, "but it carries over ninety-nine percent of the risk." A Social Security number may sit next to a bank balance in the same record. The balance matters to the model; the identifier usually doesn't.

Thirty years ago, he said, the main fear was someone stealing a hard drive. Today, older databases sit inside data clouds such as Databricks and Snowflake, and models and agents use MCP and other protocols to pull data in real time, increasingly without a human in the loop. "You cannot scan and redact and encrypt your way out," he said. Protection has to happen in the runtime flow of data.

How should enterprises protect sensitive data for AI?

Sternberg described three capabilities: detect and classify sensitive data, secure and tokenize it, and govern and audit access. Periodic scans that produce a dashboard aren't enough, he said, because teams have to act on what they find.

He compared the approach to how identity providers protect passwords and how secrets managers protect keys: sensitive data deserves its own zero-trust architecture. He cited Netflix as an early example of a company that moved from microservices passing personal data around to a single vault service that authorized applications call.

Detection has to work across formats, from sentences with misspellings to PDFs, JSON, XML and HTML. Skyflow uses a named entity recognition model to read context, which Sternberg called solving "the Paris Hilton problem": telling a person's name from a hotel brand and a city in the same sentence.

How can AI use data it isn't allowed to see?

Sternberg walked through a customer service transcript with several people, phone numbers and email addresses. The traditional options are to strip that data out, which leaves the model unable to answer, or to block the use case. Skyflow instead replaces each sensitive value with a consistent token, so the model can still tell one customer from another. Asked who the primary contact is, the model answers using tokens, and an authorized user sees the real details after governed re-identification.

He said policies need to cover both directions: what flows into the model and what flows back to the user. A model shouldn't see a Social Security number, and a user shouldn't see the CEO's salary just because the model surfaced it. "The non-deterministic nature of LLMs require deterministic controls," he said.

What's the takeaway?

Chatbots, MCP servers, training data and pipelines from storage are all connected, Sternberg said, so data needs the same protection wherever it flows. His summary: agents can't leak data they don't have, and data can be protected in a way that preserves its context.

Where to hear more in 2027

AI security and privacy will remain on the agenda at the 2027 ALIGN AI Executive Summits, invitation-only gatherings for data and AI executives in eight U.S. cities. Registration is coming soon. Details are on the ALIGN AI Executive Summits page.

Frequently asked questions

Why is sensitive data a barrier to production AI?

It is the most useful and most risky data, so compliance reviews often block AI projects that need it.

How can LLMs use sensitive data safely?

Detect and classify it, replace it with consistent tokens so the model keeps context, and re-identify it only for authorized users under policy.

Why doesn't redaction work for AI?

Stripping data out removes context the model needs to answer, and periodic scans can't protect data flowing to agents in real time.

This article is based on remarks by Sam Sternberg, Global Head of Solutions, Skyflow at ALIGN AI Executive Summit New York City 2026 on June 25, 2026. More coverage: ALIGN AI Executive Summits.

Filed under: Security & Fraud, AI Governance & Trust, Data & AI Infrastructure