Data-centric security is a protection model that follows the information itself instead of relying on a fixed network boundary. Controls are attached to the data through classification, encryption, access rules, tokenization, and monitoring, so protection still applies when files move between cloud storage, SaaS apps, endpoints, APIs, or AI workflows.
This matters because modern attacks often target the paths around data, not just the server that stores it. A misconfigured connector, overly broad API permission, or weak identity check can expose sensitive records even if the network is hardened. Defenders use data-centric security to limit who can open, copy, export, or process information, and to detect unusual movement or sharing. In practice, it supports least-privilege access, strong key management, and policy enforcement at the resource level.