In October, Arrakis Security published its 2026 Autonomous Agents Threat Report, built on 12 weeks of telemetry from thousands of agents in its customers’ environments. It found that 70% of agents can reach sensitive systems, such as cloud storage, AI services, and marketing platforms, and 99.4% of those had no verified data loss prevention on that connection.
Source: Arrakis Security, 2026 Autonomous Agents Threat Report, Oct. 2026.
That is the DLP gap in numbers. This post compares DLP, DSPM, and a data security platform when the thing reaching your data is an agent.
Both categories are adding agent features
Vendors are extending DLP to agents. Cyera (August 2026), for example, says its endpoint product applies the same data protection controls wherever agents run, including desktop AI apps. DSPM vendors now map which data each agent can reach. Both are natural extensions, and both still work at the exit or on the map.
The gap did not move
| Approach | In the agent era | What stays open |
|---|---|---|
| DLP | Watches or blocks data moving toward an agent or a device. | Data already sitting still, and files it cannot read. |
| DSPM | Maps what an agent can reach and flags over-access. | Fixing what it finds. The fix often lands in a ticket. |
| Data security platform | Finds the data, then encrypts, masks, or redacts it. The protection stays on the file when an agent copies it, and an agent without access to the key can’t read it. | Stopping a transfer mid-send. Protection on the file covers what happens after it leaves. |
Speed widens the gap
In October, CrowdStrike reported that a China-linked group it tracks as VAPOR PANDA ran an AI agent framework, ARTEX, against more than 200 organizations in 11 days. CrowdStrike confirmed intrusions at nine of them, and a human operator steered the agents only at decision points. A review queue is built for a person’s pace. These agents ran in parallel.
Source: CrowdStrike, VAPOR PANDA threat report, Oct. 2026.
A file that PK Protect has already encrypted doesn’t wait for anyone to respond to an alert. The protection is on the file however fast the agents move, and an agent that hasn’t been given access to the key can’t read it. Keys go only to the directory groups that need them, so a credential lifted from a config file or a cloud role doesn’t come with a key unless that identity was given one.