All Resources
In this article:
minus iconplus icon
Share the Blog

Cloud Data Breaches: Cloud vs On Premise Security

January 24, 2023
3
 Min Read
Data Security

"The cloud is more secure than on prem.” This has been taken for granted for years, and is one of the many reasons companies are adopting a ‘cloud first mentality’. But when it comes to data breaches this isn’t always the case.

That’s why you still can’t find a good answer to the question “Is the cloud more secure than on-premise?”

Because like everything else in security, the answer is always ‘it depends’. While having certain security aspects managed by the cloud provider is nice, it’s hardly comprehensive. The cloud presents its own set of data security concerns that need to be addressed.

In this blog, we’ll be looking at data breaches in the cloud vs on premises. What are the unique data security risks associated with both use cases, and can we definitively say one is better at mitigating the risks of data breaches? 

On Premises Data Security

An on-premise architecture is the traditional way organizations manage their networks and data. The company’s servers, hardware, software, and network are all managed directly by the IT department, which assumes full control over uptime, security, and data. While more labor intensive than cloud infrastructures, on-premise architectures have the advantage of having a perimeter to defend. Unlike the cloud,  IT and security teams also know exactly where all of their data is - and where it’s supposed to be. Even if data is duplicated without authorization, it’s duplicated in the on-prem server, with existing perimeter protections in place. The advantage of these solutions can’t be overstated. IT has decades of experience managing on-premise servers and there are hundreds of tested products on the market that do an excellent job of securing an on-prem perimeter.  

Despite these advantages, around half of data breaches are still from on-premise architectures rather than cloud. This is caused by a number of factors. Most importantly, cloud providers like Amazon Web Services, Azure, and GCP are responsible for some aspects of security. Additionally, while securing a perimeter might be more straightforward than the defense in depth approach required for the cloud, it’s also easier for attackers to find and exploit on-premise vulnerabilities by easily searching public exploit databases and then finding organizations that haven’t patched the relevant vulnerability. 

Data Security in the Cloud 

Infrastructure as a Service (IaaS) Cloud computing runs on a ‘shared responsibility model’. The cloud provider is responsible for the hardware, so they provide the physical security, but protecting the software, applications, and data is still the enterprise’s responsibility. And while some data leaks are the result of poor physical security, many of the major leaks today are the result of misconfigurations and vulnerabilities, not someone physically accessing a hard drive. 

So when people claim the cloud is better for data security than on premises, what exactly do they mean?

Essentially they’re saying that data in the cloud is more secure when the cloud is correctly set up. And no, this is not as obvious as it sounds. Because by definition the cloud needs to be accessed through the internet, that also makes it shockingly easy to accidentally expose data to everyone through the internet.

For example, S3 buckets that are improperly configured have been responsible for some of the most well known cloud data breaches, including Booz Allen Hamilton , Accenture, and Prestige Software. This just isn’t a concern for on-prem organizations.  There’s also the matter of the quantity of data being created in the cloud. Because the cloud is provisioned on demand, developers and engineers can easily duplicate databases and applications, and accidentally expose the duplicates to the internet. 

Amazon’s warning against leaving buckets exposed to the internet

Securing your cloud against data breaches is also complicated by the lack of a definable perimeter. When everything is accessible via the internet with the right credentials, guarding a ‘perimeter’ isn’t possible. Instead cloud security teams manage a range of security solutions designed to protect different elements of their cloud - the applications, the networking, the data, etc. And they have to do all of this without slowing down business processes. The whole advantage of moving to the cloud is speed and scalability. If security prevents scalability, the benefits of the cloud vanish. 

So we see with the cloud there’s a basic level of security features you need to enable. The good news is that once those features are enabled, the cloud is much harder for an attacker to navigate. There’s monitoring built in to which makes breaches more difficult. It’s also a lot more difficult to understand a cloud architecture than an on-premise one, which means that attackers either have to be more sophisticated or they just go for the low-hanging fruit (exposed s3 buckets being a good example of this). 

However, once you have your monitoring built in, there’s still one challenge facing cloud-first organizations. That’s the data. No matter how many cloud security experts you have, there’s data being constantly created in the cloud that security may not even be aware exists. There’s no issue of visibility on premises - we know where the data is. It’s on the server we’re managing. In the cloud, there’s nothing stopping developers from duplicating data, moving it between environments, and forgetting about it completely (also known as shadow data). Even if you were able to discover the data, it’s no longer clear where it came from, or what security posture it’s supposed to have. Data sprawl leading to a loss of visibility, context, which damages your security posture is the primary cloud security challenge.  

So what’s the verdict on data breaches in the cloud vs data breaches on premises? Which is riskier or more likely? 

Is the Cloud More Secure Than On Premise?

Like we warned in the beginning, the answer is an unsatisfying “it depends”. If your organization properly manages the cloud, configures the basic security features, limits data sprawl, and has cloud experts managing your environment, the cloud can be a fortress. Ultimately though, this may not be a conversation most enterprises are having in the coming years. With the advantages of scalability and speed, many new enterprises are cloud-first and the question won’t be ‘is the cloud secure’ but is our cloud’s data secure.

Discover Ron’s expertise, shaped by over 20 years of hands-on tech and leadership experience in cybersecurity, cloud, big data, and machine learning. As a serial entrepreneur and seed investor, Ron has contributed to the success of several startups, including Axonius, Firefly, Guardio, Talon Cyber Security, and Lightricks, after founding a company acquired by Oracle.

Subscribe

Latest Blog Posts

David Stuart
David Stuart
May 5, 2025
4
Min Read
Compliance

What the HIPAA Compliance Updates Mean for Your Security

What the HIPAA Compliance Updates Mean for Your Security

The Health Insurance Portability and Accountability Act (HIPAA) has long been a cornerstone of safeguarding sensitive health information in the U.S., particularly electronic protected health information (ePHI). As healthcare organizations continue to face growing cybersecurity challenges, ensuring the protection of ePHI has never been more critical. 

In response, for the first time in two decades, the U.S. Department of Health and Human Services (HHS) has proposed significant amendments to the HIPAA Security Rule, aimed at strengthening cybersecurity measures across the healthcare sector. These proposed changes are designed to address emerging threats and ensure that healthcare organizations have robust systems in place to protect patient data from unauthorized access and potential breaches. This blog presents the major changes that are coming soon and how you can prepare for them.

Instead of considering compliance as a one-time effort, with Sentra you can monitor your compliance status at any given moment, streamline reporting, and remediate compliance violations instantly.

How Sentra Can Help You Stay Compliant

Sentra’s data security platform equips healthcare organizations with the necessary tools to stay compliant with the new HIPAA Security Rule amendments. By providing continuous monitoring of ePHI data locations and assessing associated risks, Sentra helps organizations maintain full visibility and control over sensitive data.

Key Benefits of Using Sentra for HIPAA Compliance:

  • Automated Data Discovery & Classification: Instantly locate and classify ePHI across cloud and on-prem environments.
  • Real-time Risk Assessment: Continuously assess vulnerabilities and flag security gaps related to HIPAA requirements.
  • Access Control & Encryption Monitoring: Ensure compliance with mandatory MFA, encryption policies, and access termination requirements.
  • Smart Compliance Alerts: Sentra doesn’t just detect generic cloud misconfigurations. Instead, it pinpoints security issues affecting sensitive data, helping teams focus on what truly matters.

Without a solution such as Sentra, organizations waste valuable time manually searching for and classifying sensitive data, diverting key employees from higher-priority security tasks. With Sentra, security teams gain an ongoing, real-time dashboard that ensures efficient compliance and faster risk mitigation.

What You Need to Know About the Proposed HIPAA Security Rule Updates

The latest proposed updates to the HIPAA Security Rule represent some of the most significant changes in years. These updates aim to modernize data protection practices and ensure healthcare organizations are better equipped to handle today’s security challenges. Below are the key highlights compliance and security teams should focus on:

Mandatory Implementation Specifications
All implementation specifications under the HIPAA Security Rule will become mandatory. Covered entities and business associates must now fully comply with all safeguards—no more "addressable" exceptions.

Stricter Encryption Requirements
Encryption of electronic protected health information (ePHI) will be required both at rest and in transit. Organizations must ensure encryption is in place across all systems handling sensitive data.

Required Multifactor Authentication (MFA)
MFA will become mandatory to protect access to ePHI. This added security layer significantly reduces the risk of unauthorized access and credential compromise.

Network Segmentation for Threat Containment
Organizations must implement network segmentation to isolate sensitive systems and limit the spread of cyber threats in the event of a breach.

Timely Termination of Access
Access to ePHI must be revoked within 24 hours when an employee leaves or changes roles. This reduces the risk of insider threats and unauthorized access.

Comprehensive Documentation Requirements
Healthcare organizations must maintain detailed, up-to-date documentation of all security policies, procedures, risk assessments, and incident response plans.

Asset Inventories and Network Mapping
Annual updates to technology asset inventories and network maps will be required to ensure accurate tracking of where and how ePHI is stored and transmitted.

Enhanced Risk Analysis
Organizations must conduct regular, thorough risk assessments to identify vulnerabilities and assess threats across all systems that interact with ePHI.

Stronger Incident Response Plans
Entities must be able to restore lost systems and data within 72 hours after a cyber incident. Regular testing and refinement of incident response protocols will be essential.

Annual Compliance Audits
Healthcare organizations will be required to conduct annual audits of their HIPAA Security Rule compliance, covering all technical and administrative safeguards.

Mandatory Technical Controls
Technical safeguards like anti-malware tools, firewalls, and port restrictions must be in place and regularly reviewed to protect systems from evolving threats.

What’s Next?

The proposed changes to the HIPAA Security Rule are currently in the Notice of Proposed Rulemaking (NPRM) stage, with a 60-day public comment period that opened on January 6, 2025. During this period, stakeholders can provide feedback on the amendments, which may influence the final rule. Organizations should actively monitor the comment period, engage in the feedback process, and stay informed on any potential adjustments before the rule is finalized.

Steps Organizations Should Take Now:

  • Review the proposed changes and understand how they impact your current security posture.
  • Engage in the public comment process to share concerns or recommendations.
  • Start assessing security gaps to align with HIPAA’s evolving compliance requirements.

Conclusion

The new HIPAA compliance amendments represent a major shift in how healthcare organizations must protect electronic Protected Health Information (ePHI). The introduction of enhanced encryption standards, mandatory multi-factor authentication (MFA), and stricter access control measures means organizations must act swiftly to maintain compliance and reduce cybersecurity risks.

Compliance is not just about meeting regulations, it is about efficiency. Organizations relying on manual processes to locate and secure sensitive data waste valuable time and resources, making compliance efforts less effective.

With Sentra, healthcare organizations gain a powerful, automated data security solution that:

  • Eliminates manual data discovery by providing a real-time, continuous inventory of sensitive data.
  • Prioritizes relevant data security risks instead of overwhelming teams with unnecessary alerts.
  • Ensures compliance readiness by automating key processes like access control monitoring and encryption verification.

Now is the time for healthcare organizations to take proactive steps toward compliance. Stay informed, participate in the public comment process, and start implementing security enhancements today.

To learn how Sentra can help your organization achieve HIPAA compliance efficiently, request a demo today and take control of your sensitive data.

Read More
Yoav Regev
Yoav Regev
April 23, 2025
3
Min Read
Data Security

Your AI Is Only as Secure as Your Data: Celebrating a $100M Milestone

Your AI Is Only as Secure as Your Data: Celebrating a $100M Milestone

Over the past year, we’ve seen an incredible surge in enterprise AI adoption. Companies across industries are integrating AI agents and generative AI into their operations to move faster, work smarter, and unlock innovation. But behind every AI breakthrough lies a foundational truth: AI is only as secure as the data behind it.

At Sentra, securing that data has always been our mission, not just to prevent breaches and data leaks, but to empower prosperity and innovation with confidence and control.

Data Security: The Heartbeat of Your Organization

As organizations push forward with AI, massive volumes of data, often sensitive, regulated, or business-critical are being used to train models or power AI agents. Too often, this happens without full visibility or governance. 


The explosion of the data security market reflects how critical this challenge has become. At Sentra, we’ve long believed that a Data Security Platform (DSP) must be cloud-native, scalable, and adaptable to real-world enterprise environments. We’ve been proud to lead the way, and our continued growth, especially among Fortune 500 customers, is a testament to the urgency and relevance of our approach.

Scaling for What's Next

With the announcement of our $50 million Series B funding round, bringing our total funding to over $100 million, we’re scaling Sentra to meet the moment. We're counting on strong customer momentum and more than tripling revenue year-over-year, and we’re using this investment to grow our team, strengthen our platform, and continue defining what modern data security looks like.

We’ve always said security shouldn’t slow innovation - it should fuel it. And that’s exactly what we’re enabling.

It's All About the People


At the end of the day, it’s people who build it, scale it, and believe in it. I want to extend a heartfelt thank you to our investors, customers, and, most importantly, our team. It’s all about you! Your belief in Sentra and your relentless execution make everything possible. We couldn’t make it without each and every one of you.

We’re not just building a product, we’re setting the gold standard for data security, because securing your data is the heartbeat of your organization!

Innovation without security isn’t progress. Let’s shape a future where both go together!

Read More
Meni Besso
Meni Besso
April 21, 2025
Min Read
Compliance

How to Scale DSAR Compliance (Without Breaking Your Team)

How to Scale DSAR Compliance (Without Breaking Your Team)

Privacy regulations such as GDPR (EU), CCPA/CPRA (California), and others are not just about legal checkboxes, they’re about building trust. In today’s data-driven world, customers expect organizations to be transparent about how their personal information is collected, used, and protected. When companies take privacy seriously, they demonstrate respect for their users, which in turn fosters loyalty and long-term engagement.

But among the many privacy requirements, Data Subject Access Requests (DSARs) can be the most complex to support. DSARs give individuals the right to request access to the personal data that an organization holds about them—often with a firm deadline of just 30 days to respond. For large enterprises with data scattered across multiple systems, both in the cloud and on-premises, even a single request can trigger a chaotic search across different platforms, manual reviews and legal oversight—it quickly becomes a race against the clock, with compliance, trust, and reputation on the line.

Key Challenges in Responding to DSARs

Data Discovery & Inventory
For large organizations, pinpointing where personal data resides across a diverse ecosystem of information systems, including databases, SaaS applications, data lakes, and legacy environments, is a complex challenge. The presence of fragmented IT infrastructure and third-party platforms often leads to limited visibility, which not only slows down the DSAR response process but also increases the likelihood of missing or overlooking critical personal data.

Linking Identities Across Systems
A single individual may appear in multiple systems under different identifiers, especially if systems have been acquired or integrated over time. Accurately correlating these identities to compile a complete DSAR response requires sophisticated identity resolution and often manual effort.


Unstructured Data Handling
Unlike structured databases, where data is organized into labeled fields and can be efficiently queried, unstructured data (like PDFs, documents, and logs) is free-form and lacks consistent formatting. This makes it much harder to search, classify, or extract relevant personal information.

Response Timeliness
Regulatory deadlines force organizations to respond quickly, even when data must be gathered from multiple sources and reviewed by legal teams. Manual processes can lead to delays, risking non-compliance and fines.

Volume & Scalability
While most organizations can handle an occasional DSAR manually, spikes in request volume — driven by events like regulatory campaigns or publicized incidents — can overwhelm privacy and legal teams. Without scalable automation, organizations face mounting operational costs, missed deadlines, and an increased risk of inconsistent or incomplete responses.


The Role of Data Security Platforms in DSAR Automation

Sentra is a modern data security platform dedicated to helping organizations gain complete visibility and control over their sensitive data. By continuously scanning and classifying data across all environments (including cloud, SaaS, and on-premises systems) Sentra maintains an always up-to-date data map, giving organizations a clear understanding of where sensitive data resides, how it flows, and who has access to it. This data map forms the foundation for efficient DSAR automation, enabling Sentra’s DSAR module to search for user identifiers only in locations where relevant data actually exists - ensuring high accuracy, completeness, and fast response times.

Data Security Platform example of US SSN finding

Another key factor in managing DSAR requests is ensuring that sensitive customer PII doesn’t end up in unauthorized or unintended environments. When data is copied between systems or environments, it’s essential to apply tokenization or masking to prevent unintentional sprawl of PII. Sentra helps identify misplaced or duplicated sensitive data and alerts when it isn’t properly protected. This allows organizations to focus DSAR processing within authorized operational environments, significantly reducing both risk and response time.

Smart Search of Individual Data

To initiate the generation of a Data Subject Access Request (DSAR) report, users can submit one or more unique identifiers—such as email addresses, Social Security numbers, usernames, or other personal identifiers—corresponding to the individual in question. Sentra then performs a targeted scan across the organization’s data ecosystem, focusing on data stores known to contain personally identifiable information (PII). This includes production databases, data lakes, cloud storage services, file servers, and both structured and unstructured data sources.

Leveraging its advanced classification and correlation capabilities, Sentra identifies all relevant records associated with the provided identifiers. Once the scan is complete, it compiles a comprehensive DSAR report that consolidates all discovered personal data linked to the data subject that can be downloaded as a PDF for manual review or securely retrieved via Sentra’s API.

DSAR Requests

Establishing a DSAR Processing Pipeline

Large organizations that receive a high volume of DSAR (Data Subject Access Request) submissions typically implement a robust, end-to-end DSAR processing pipeline. This pipeline is often initiated through a self-service privacy portal, allowing individuals to easily submit requests for access or deletion of their personal data. Once a request is received, an automated or semi-automated workflow is triggered to handle the request efficiently and in compliance with regulatory timelines.

  1. Requester Identity Verification: Confirm the identity of the data subject to prevent unauthorized access (e.g., via email confirmation or secure login).

  2. Mapping Identifiers: Collect and map all known identifiers for the individual across systems (e.g., email, user ID, customer number).

  3. Environment-Wide Data Discovery (via Sentra): Use Sentra to search all relevant environments — cloud, SaaS, on-prem — for personal data tied to the individual. By using Sentra’s automated discovery and classification, Sentra can automatically identify where to search for.

  4. DSAR Report Generation (via Sentra): Compile a detailed report listing all personal data found and where it resides.

  5. Data Deletion & Verification: Remove or anonymize personal data as required, then rerun a search to verify deletion is complete.

  6. Final Response to Requester: Send a confirmation to the requester, outlining the actions taken and closing the request.

Sentra plays a key role in the DSAR pipeline by exposing a powerful API that enables automated, organization-wide searches for personal data. The search results can be programmatically used to trigger downstream actions like data deletion. After removal, the API can initiate a follow-up scan to verify that all data has been successfully deleted.

Benefits of DSAR Automation 

With privacy regulations constantly growing, and DSAR volumes continuing to rise, building an automated, scalable pipeline is no longer a luxury - it’s a necessity.


  • Automated and Cost-Efficient: Replaces costly, error-prone manual processes with a streamlined, automated approach.
  • High-Speed, High-Accuracy: Sentra leverages its knowledge of where PII resides to perform targeted searches across all environments and data types, delivering comprehensive reports in hours—not days.
  • Seamless Integration: A powerful API allows integration with workflow systems, enabling a fully automated, end-to-end DSAR experience for end users.

By using Sentra to intelligently locate PII across all environments, organizations can eliminate manual bottlenecks and accelerate response times. Sentra’s powerful API and deep data awareness make it possible to automate every step of the DSAR journey - from discovery to deletion - enabling privacy teams to operate at scale, reduce costs, and maintain compliance with confidence. 

Turning DSAR Compliance into a Scalable Advantage

As privacy expectations grow and regulatory pressure intensifies, DSARs are no longer just a checkbox. They are a reflection of how seriously an organization takes user trust. Manual, reactive processes simply can’t keep up with the scale and complexity of modern data environments.

By automating DSAR workflows with tools like Sentra, organizations can achieve faster response times, lower operational costs, and sustained compliance - while freeing up teams to focus on higher-value privacy initiatives.

Read More
decorative ball