Data Security & Cyber Resilience | Thales Solutions via Cybergen

Cyber resilience is often discussed in terms of stopping attacks, recovering systems and maintaining business continuity. However, underneath each of these objectives sits something even more fundamental: the security of the organisation’s data.

Attackers rarely compromise a business simply to demonstrate that they can bypass a firewall or access a network. Their objective is usually the information contained within it. Customer records, employee details, financial information, intellectual property, credentials, operational data and commercially sensitive documents can all be stolen, encrypted, manipulated or used as leverage.

This is why data security has moved from being a technical control to becoming a central part of business resilience.

An organisation may be able to rebuild a server, replace a device or restore an application. It cannot easily reverse the consequences of sensitive data being published, sold, fraudulently used or permanently exposed. Once information has left the organisation’s control, the damage can extend far beyond the original incident.

Modern cyber resilience must therefore protect more than networks and endpoints. It must protect the data itself throughout its lifecycle: wherever it is created, stored, accessed, processed, shared or archived.

Through its partnership with Thales, Cybergen helps organisations establish this data-centric approach, combining visibility, encryption, key management, identity security and access controls to protect the information their operations depend upon.

Data has become one of the most valuable assets held by modern organisations. It supports decision-making, customer relationships, product development, regulatory reporting and almost every critical business process.

It is also highly attractive to cybercriminals.

Personal information can be used for identity theft and fraud. Credentials can provide access to other systems. Intellectual property can be sold to competitors or hostile groups. Financial records may support highly targeted scams. Sensitive corporate information can be used for extortion, while operational data can help attackers understand how to disrupt essential services.

Ransomware demonstrates this shift particularly clearly. Earlier ransomware campaigns concentrated primarily on encrypting systems and demanding payment for a decryption key. Modern attacks frequently involve data theft before encryption. Criminal groups can then threaten to publish the stolen information even if the victim restores its systems from backups.

This means that reliable backups, while essential, are no longer enough on their own. A business might recover its applications and still face regulatory investigations, legal action, reputational damage and commercial losses because its data has been compromised.

Attackers also target the systems and identities that provide access to information. Rather than attempting to defeat every layer of technical security, they may steal a legitimate user’s credentials, abuse excessive permissions or exploit an unmonitored cloud account. If the activity appears to come from an authorised identity, traditional security controls may struggle to identify it.

Protecting data therefore requires organisations to understand not only where information is located, but also who can access it, how it is protected and what happens when it is used.

Traditional security strategies were built around a clearly defined perimeter. Employees worked from corporate offices, applications ran in internal data centres and sensitive information remained within networks controlled by the organisation.

Security teams could place controls around that environment and inspect the traffic entering or leaving it.

That model no longer reflects how most organisations operate.

Data now moves continuously between cloud platforms, software-as-a-service applications, remote users, mobile devices, suppliers, customers and AI tools. Employees may access the same information from an office workstation, a personal location or a mobile device. Applications can process information across several cloud providers, while third parties may require temporary or permanent access to key systems.

The perimeter has not simply expanded. In many organisations, it has become difficult to define at all.

A data-centric security model starts from a different position. Instead of relying primarily on the location of the information, it applies protection directly to the data and the identities that use it.

This involves identifying and classifying sensitive information, encrypting it wherever appropriate, controlling access according to business need and continuously monitoring how it is being used. Protection remains attached to the data even as it travels through complex hybrid and multi-cloud environments.

This does not make network, endpoint or application security obsolete. It ensures that when another control fails, the information itself remains significantly harder to access or exploit.

Cloud adoption and expanding data estates

Cloud services have transformed the way organisations operate. They offer scalability, flexibility and rapid access to new capabilities, but they can also create fragmented data environments.

A single organisation may use Microsoft Azure, Amazon Web Services, Google Cloud, dozens of SaaS platforms and a range of specialist industry applications. Each environment may have different security settings, access models, encryption capabilities and key-management processes.

This complexity makes it difficult to answer apparently simple questions:

• What sensitive data do we hold?

• Where is it stored?

• Who can access it?

• Is it encrypted?

• Who controls the encryption keys?

• Is the data being shared with third parties?

• Are permissions still appropriate?

• Would we detect unusual access or extraction?

Without consistent answers, security teams are often managing risk based on an incomplete picture.

Cloud services also operate under a shared-responsibility model. Cloud providers secure their infrastructure, but customers remain responsible for how they configure their services, protect their identities and handle their information. Moving data to the cloud does not transfer accountability for securing it.

Hybrid environments

Many organisations are not completely cloud-based. They operate hybrid environments containing legacy applications, on-premises infrastructure, private clouds, operational technology and newer SaaS services.

These systems may have been deployed at different times, by different teams and according to different security standards. Data can be copied between them for reporting, analytics, testing, backup or operational purposes.

Every copy creates another asset to discover, manage and protect.

Legacy systems may not support modern security controls without additional technology. At the same time, cloud-native systems can be deployed so quickly that security teams struggle to maintain oversight. The result is often inconsistent protection: highly sensitive information may be strongly encrypted in one system but inadequately controlled in another.

A resilient data-security strategy must work across the whole estate rather than protecting only the newest or most visible platforms.

AI-driven data exposure

Artificial intelligence has added another layer of complexity. Employees can now use generative AI to draft documents, analyse information, summarise meetings, write code and automate everyday tasks.

These tools can create significant productivity benefits, but they also make it easier for information to leave approved environments.

An employee might paste client information into an unsanctioned AI service, upload a commercially sensitive document to generate a summary or connect an AI application to a corporate repository without understanding the permissions involved. Developers may expose credentials in prompts, while business teams can adopt AI-enabled tools before they have been assessed by security or compliance functions.

This is not always malicious behaviour. In many cases, employees are simply trying to work more efficiently. Nevertheless, the organisation can lose visibility over where its data has gone, how long it will be retained and whether it could be used by a third party.

The 2026 Thales Data Threat Report found that 70% of organisations ranked AI as their leading data-security risk. This reflects a wider truth: organisations cannot secure AI effectively without first securing the data that powers it.

AI governance must therefore extend beyond producing a policy. Organisations need the ability to understand which AI services employees are using, identify risky behaviour, protect sensitive information and guide people towards safer ways of working. This combines technical controls with employee awareness and practical intervention at the point of risk.

Insider threats and compromised identities

Not every data incident begins with an external attacker breaking into the network. Information can also be exposed by employees, contractors, suppliers or trusted partners.

Insider risk includes deliberate theft, but accidental behaviour is far more common. A user may send a document to the wrong recipient, share a folder too widely, upload information to an unapproved service or retain access after changing roles.

Compromised accounts create a similar problem. If an attacker obtains legitimate credentials, their activity may initially resemble normal user behaviour. The risk becomes much greater when the account has excessive permissions or when strong authentication is not required.

This is why access management is inseparable from data security.

Organisations need confidence that users are who they claim to be, that access is proportionate to their responsibilities and that unusual behaviour can be identified quickly.

Traditional security tools frequently focus on individual parts of the technology environment: a device, a network connection, an application or a known malicious file.

These controls continue to play an important role, but they do not necessarily provide a consistent view of the data moving between those systems.

Information can now travel through APIs, collaboration platforms, cloud storage, personal devices, AI services and third-party applications without passing through a conventional corporate perimeter. If security policies are tied only to a particular network or platform, protection can weaken as soon as the data moves elsewhere.

Visibility is another major challenge. Different teams may operate separate security tools with their own dashboards, policies and alerts. Cloud teams, identity teams, compliance functions and security operations may each see only one part of the overall risk.

This fragmentation creates gaps. One team may know that sensitive data exists in a repository, while another controls the identities that can access it. Unless those insights are connected, the organisation may not recognise that a highly privileged account is accessing critical information from an unusual location.

Compliance requirements add further complexity. Organisations may need to demonstrate appropriate controls under the UK GDPR, PCI DSS, DORA, NIS2, sector-specific regulations, contractual obligations or international data-sovereignty rules.

Meeting these requirements through isolated manual processes is difficult to scale. Organisations need consistent controls, centralised reporting and reliable evidence showing how sensitive information is being protected.

Encryption converts readable data into a protected format that can only be accessed using the appropriate cryptographic key. If encrypted information is stolen without the corresponding key, it is significantly more difficult for an attacker to use.

Effective encryption can protect data at rest in databases and storage systems, in transit between users and applications, and in use within appropriate processing environments.

However, encryption is only as strong as the way its keys are managed.

Keys must be generated securely, stored separately, rotated when required and made available only to authorised systems or users. If encryption keys are poorly controlled or stored alongside the protected information, an attacker may be able to obtain both.

Centralised key management helps organisations apply consistent policies across on-premises infrastructure and multiple cloud providers. It can also support bring-your-own-key and hold-your-own-key models, giving organisations greater control over cloud-hosted information and helping address sovereignty or regulatory requirements.

Access management provides the other half of the equation. Encryption protects the data, while identity and access controls determine who is permitted to unlock, view or use it.

Strong access security should include:

• Multi-factor authentication

• Context-aware access policies

• Role-based permissions

• Least-privilege access

• Separation of duties

• Regular access reviews

• Prompt removal of unnecessary accounts

• Monitoring and auditing of access events.

These measures reduce the likelihood that a stolen password, compromised user or excessive privilege will lead directly to a serious data breach.

Thales provides a range of technologies designed to protect data and control access across cloud, hybrid and on-premises environments.

Data discovery, classification and protection

The Thales CipherTrust Data Security Platform brings together data discovery, classification, protection and centralised management for cryptographic keys and secrets.

Discovery and classification provide the foundation. An organisation cannot apply appropriate protection if it does not know where sensitive information exists or understand its value.

By identifying data across the environment and classifying it according to sensitivity or regulatory status, organisations can focus controls on the assets that present the greatest risk. This supports more informed decisions about encryption, access, retention and monitoring.

The objective is not simply to collect more alerts. It is to establish a clear and manageable view of sensitive information throughout the organisation.

Encryption and key management

Thales supports encryption across databases, files, applications, virtualised infrastructure, containers and cloud services. This allows organisations to apply data-centric protection without relying entirely on the security controls of an individual platform.

At the centre of the Thales approach is CipherTrust Manager, which provides centralised management for keys, secrets, certificates and cryptographic policies across hybrid, multi-cloud and on-premises environments.

Centralisation helps reduce the complexity of managing separate key systems for every platform. It can provide clearer ownership, consistent lifecycle management, separation of duties and the audit information needed to demonstrate control.

For organisations using multiple cloud providers, Thales can also support cloud-native keys and bring-your-own-key or hold-your-own-key strategies. This gives the organisation greater flexibility over where keys are held and how access to encrypted cloud data is governed.

Identity and access management

Thales SafeNet Trusted Access helps organisations manage authentication and access to cloud services and enterprise applications.

It can extend multi-factor authentication, apply access policies and provide visibility into access events across the application estate. The aim is to ensure that the right person reaches the right resource at an appropriate level of trust.

Authentication can also be adapted according to context. A routine request from a recognised device and location may be treated differently from an attempt involving a new device, unusual location or sensitive application.

This approach strengthens security without forcing every user through the same process every time. Higher-risk events can trigger stronger authentication, while normal business activity remains efficient.

Compliance-focused security

Data-security technology cannot guarantee compliance on its own.

Compliance depends on governance, policies, processes, people and evidence.

However, Thales solutions can help organisations implement and demonstrate many of the technical controls expected by regulators, auditors and customers. These can include data discovery, encryption, access control, separation of duties, centralised key management and audit reporting.

Cybergen helps organisations connect these capabilities to their wider security and compliance objectives. Rather than deploying a product in isolation, we assess the information being protected, the threats it faces and the standards or regulations the organisation must satisfy.

This allows the technical design to reflect genuine business risk.

Visibility is the starting point for effective protection.

Many organisations have accumulated data over several years without a complete understanding of where it is held. Information may sit in forgotten databases, duplicated cloud storage, shared drives, test systems, personal folders or inactive SaaS accounts.

If the organisation cannot locate its sensitive data, it cannot confidently encrypt it, restrict access to it or determine whether it has been exposed.

Visibility must include more than location. Security teams also need to understand:

• The sensitivity and business value of the data

• The systems and processes that depend upon it

• The identities with access

• Whether access remains necessary

• How the information is protected

• Where encryption keys are stored

• Whether the data is being moved or copied

• Which events indicate unusual behaviour.

This context allows organisations to prioritise risk. A public marketing document does not require the same controls as payment information, legal records or intellectual property. Similarly, an unsuccessful login attempt does not carry the same significance as a privileged account downloading a large volume of sensitive files.

Effective monitoring brings data, identity and activity together. It gives security teams the information needed to distinguish normal operations from behaviour that may indicate compromise, misuse or preparation for data theft.

The earlier suspicious activity is identified, the greater the opportunity to contain it before it becomes a major incident.

Reduced breach risk

Encryption, key management, strong authentication and appropriate access controls create multiple barriers between an attacker and the organisation’s information.

No control removes risk completely. However, a data-centric strategy can reduce the likelihood that one compromised account, device or system leads to the widespread exposure of sensitive information.

Greater compliance confidence

Centralised controls and reporting make it easier to demonstrate how regulated information is protected.

Instead of relying on assumptions or scattered evidence, organisations can provide clearer records of access, encryption, key ownership and policy enforcement. This can simplify audit preparation and support conversations with regulators, customers and insurers.

Improved operational resilience

Data security supports recovery as well as prevention.

When an organisation understands its critical information, dependencies and access requirements, it can make better decisions during an incident. Teams can prioritise the systems and datasets that matter most, assess the likely impact more quickly and restore services in a controlled manner.

Strong key-management practices also help avoid situations in which an organisation cannot access its own encrypted information because keys have been lost, damaged or poorly administered.

Increased customer trust

Customers, employees and partners expect organisations to protect the information entrusted to them.

A serious data breach can undermine relationships built over many years. Conversely, organisations that can demonstrate mature data protection, access governance and incident readiness are better positioned to earn confidence.

Data security can therefore become a commercial differentiator. It can support procurement processes, customer assurance, market expansion and partnerships in sectors where security is a prerequisite for doing business.

Cyber resilience is ultimately about maintaining the organisation’s ability to operate, serve customers and protect its interests when something goes wrong.

That is impossible without protecting the data on which those activities depend.

As cloud adoption, hybrid working, third-party integration and enterprise AI continue to expand, organisations must move beyond security models built primarily around the network perimeter. They need to understand their information, protect it wherever it resides and tightly control the identities that can access it.

Encryption, key management, identity security and continuous visibility are no longer isolated technical projects. Together, they form a resilient layer of protection around the organisation’s most valuable digital assets.

Cybergen helps organisations evaluate their current data-security position and implement Thales solutions around real operational, regulatory and threat requirements. Whether the priority is discovering sensitive information, strengthening encryption, centralising key management, securing cloud access or reducing AI-related data exposure, we can help build a practical roadmap.

Speak to Cybergen about Thales Data Security Solutions and discover how a data-centric security strategy can strengthen your organisation’s cyber resilience.

Turquoise shield emblem with a white crowned castle on a dark blue background

The UK Cyber Security and Resilience Bill Just Reached Parliament: What Boards Need to Know Before the 24-Hour Reporting Clock Starts

September 2, 2026

What UK boards need to know about the Cyber Security and Resilience Bill, including its scope, 24-hour reporting rule, penalties and compliance steps.