In the AI era, the value of data is greater than ever. Enterprise data is no longer simply a record of business operations. It has become a critical asset that trains AI models, enables new services and determines competitive advantage.

As both the volume and quality of data increasingly shape AI competitiveness, organizations must consider not only how to acquire and use data, but also a more fundamental question: who controls it? As a result, data sovereignty is emerging as a critical issue for businesses and governments alike.

However, as the value of data grows, cyber-attacks targeting that data are also evolving rapidly. In particular, AI is fundamentally changing the economics of cyber-attacks. In the past, analyzing targets, identifying vulnerabilities, and developing attack methods required considerable expertise, time, and cost.

Today, attackers can use AI to automate significant parts of the attack process, including intelligence gathering, vulnerability analysis, phishing, and social engineering, while operating at much greater scale.

According to the World Economic Forum's Global Cybersecurity Outlook 2026, 94% of respondents identified AI as the most significant factor shaping the cybersecurity landscape, while 87% ranked AI-related vulnerabilities as the fastest-growing cyber risk. The WEF also notes that generative AI is lowering the barrier to entry for cybercrime, enabling attackers to target more victims at a lower cost.

Rethinking Cyber Defense in the AI Era

Ultimately, the cost of launching attacks is falling while their speed and scale are increasing. Defenders, meanwhile, must manage numerous systems, applications and networks, continuously identify newly discovered vulnerabilities, and deploy patches. Attackers only need to find one exploitable weakness among them. In the AI era, this asymmetry in cost and time between attackers and defenders is likely to become even more pronounced.

Therefore, attempting to prevent every cyber-attack before it happens is no longer sufficient to protect data. Preventing intrusions remains essential, but organizations must expand their security strategy from simply "preventing intrusion" to "protecting data even after an intrusion occurs."

Encryption lies at the heart of this approach.

The Last Line of Defense in the AI Era

Firewalls, web application firewalls, access controls and authentication technologies aim to prevent attackers from entering systems. Encryption serves a different purpose. Even if attackers cross those defensive boundaries and gain access to data, encryption can prevent them from making meaningful use of it.

In other words, encryption shifts the focus of protection from the perimeter of the system to the data itself. If organizations cannot prevent every attack, they must ensure that stolen data remains unusable. This requires acknowledging that intrusion prevention can never be perfect and establishing a second line of defense that can limit the real-world impact of a data breach.

However, encrypting data alone does not guarantee data sovereignty. A more important question remains: Who controls the keys used to encrypt that data?

In the AI and cloud era, data moves across on-premises infrastructure, public cloud environments, multi-cloud architectures and AI platforms. If an organization relies entirely on encryption capabilities provided by a specific cloud or infrastructure provider, its technical control over the data may also become dependent on that provider.

Therefore, data sovereignty is not simply a question of where data is stored. It is also about who protects the data, who defines the encryption policies, and, most importantly, who controls the encryption keys.

Encryption in the AI era must therefore remain independent of any particular infrastructure. Wherever data resides, enterprises and institutions should retain control over their own encryption policies and cryptographic keys. Moreover, they should be able to maintain the same data protection policies even when the underlying infrastructure changes.

Ultimately, effective data protection in the AI era requires three principles: prevent attacks as much as possible, protect the data even when a breach occurs and retain direct control over the keys that protect that data.

Attackers may be able to steal the data, but organizations must not allow them to steal its meaning.

True data sovereignty in the AI era does not end with owning the data. It is achieved only when organizations also own and control the keys that protect it.