Every day your body kills tens of billions of its own cells on purpose. This is apoptosis: programmed cell death. A cell that is old, damaged, infected, or simply no longer needed receives a signal, dismantles itself in an orderly way, and is cleared without spilling its contents or inflaming the tissue around it. It is one of the most important housekeeping functions in biology.
The body is not trying to grow without limit. It is constantly deciding what should no longer exist. When apoptosis fails, cells that should have died keep living. They accumulate. They carry their mutations forward instead of retiring them. Uncontrolled survival, as much as uncontrolled growth, is what defines cancer, and evasion of programmed death is one of its recognized hallmarks.
A tumor is, in part, a population of cells that forgot how to die. Enterprise data has the same disease. An enterprise cannot retire data that it does not see.
For a decade, companies were told: "data is the new oil." They kept everything forever because they believed it might be valuable someday, but most of it never was. What accumulates instead is shadow data: redundant, obsolete, and forgotten information that no system owns, and no one remembers creating.
Operationally, it is clutter and an annoyance because it drains network resources. From a security standpoint, it is a liability. Every stale file is one more thing that can be stolen, one more record that can leak, and one more row in a breach report.
The threat surface grows with each stale file, and AI has made that surface far easier to search, exfiltrate, and weaponize. AI also generates, copies, and reformats content at machine speed. The estate now proliferates like malignant tissue does. Stale data remains, and AI makes it worse.
A large shadow data estate is a breach waiting to happen, and it gets worse the more data you keep. In addition, keeping everything is increasingly a compliance failure. According to UNCTAD, roughly 80 percent of the world now has data protection laws, starting with the EU’s GDPR, and most regulate how long personal data records may be held.
Double Trouble
Nearly every company has a data retention policy. Very few can enforce one. The policy states how long records should live, but nothing in the environment actually ends their life when the time comes. The best that most companies can manage is removing exact duplicates, which is the easy minority of the problem. The hard part is unstructured data, where "duplicate" stops being a clean concept.
For example, the same contract can survive in multiple versions. It is first created as a .docx, then saved as a .pdf. The two documents are semantically identical, but byte-for-byte different. Different reviewers redline their own copies, producing nine versions after revision. All nine are kept long after the deal has closed because each person felt deleting the wrong one was riskier than keeping it. For a tool that matches on exact content, these are all unique files worth preserving. They are the enterprise equivalent of cells that should have been cleared and were not.
Most enterprises are missing more than a better delete function. They lack a continuous sense of what data they have, where it is, and what state it is in. Biology has a name for this sense. Medicine has a famous case of its loss.
Ian Waterman is known as the “man who lost his body.” At 19, he suffered a rare neurological illness after which he lost proprioception: the limb spatial position sensory modality that tells you, without looking, where parts of your body are in relation to one another and what they are doing.
The immediate behavioral effect was immobility even though his motor system was not paralyzed. The problem was not lack of movement per se, but lack of control. Upon awakening after three days, Waterman nightmarishly found that he had no control over what his body did. He could not sit up, walk, feed himself, or manipulate objects. He was unable to perform the ordinary actions of everyday life.
His doctors thought he would never walk again. He refused to accept this. After years of continuous effort, he taught himself to move again by watching his limbs and consciously directing every movement. Eventually, he learned to complete some movements without needing visual cues.
Generating Data Awareness
Most enterprises today operate very similarly to how Waterman did. They have data everywhere: clouds, SaaS tools, AI pipelines, and endpoints, but no continuous, embodied sense of where it is, who touches it, or what its state is.
They "walk" only by watching every step, through manual reviews and periodic audits, which worked when data moved slowly. That approach fails when AI agents are making decisions at machine speed, based on that data.
The enterprise AI promise is delegation: agents that can research, write, analyze, decide, and act. Vendors sell agentic workflows, but here's the unexamined assumption buried in almost every agentic architecture: the AI agent inherits the organization's data access, not its data awareness. Permissions set its access, with no sense of which data is sensitive, stale, or off-limits. If the organization doesn’t know where its sensitive data lives or what’s being done with it, then the agent cannot know either, and it is now acting on that ignorance at machine speed.
Gartner gave us posture management: a continuous process of discovery, assessment, and reduction of security risks. Posture is a useful metaphor, but you need proprioception to create posture dynamically, continuously, and without conscious effort.
In the business context, I call this “Organizational Information Proprioception.” In the AI era, data moves through pipelines, gets embedded in models, gets ingested by agents, and gets synthesized and re-derived. Posture is the output, but proprioception is the prerequisite.
Proprioception is the sense you can't consciously substitute, and nothing replaces it cheaply. You can close your eyes and still know where your hand is. You can't think your way to that knowledge, as it must be sensed. Similarly, an enterprise can't reason its way to knowing where all its data is at runtime. That knowledge must be instrumented and embedded as a genuine organizational sense instead of being performed as a periodic audit.
Security teams have long argued for data visibility on the grounds of breach prevention and compliance. Those arguments were always true, but they rarely won budgets because organizations optimize for growth and not risk avoidance. AI changes the calculus entirely.
Organizational Information Proprioception is now a productivity requirement. You cannot run effective AI workflows on data you cannot see. You cannot scale what you cannot measure. You cannot trust outputs from a system whose inputs you cannot account for. Ask an agent about a contract that exists in nine versions, and it will answer confidently from whichever one it finds first. The security case remains valid. It is simply not the only one.
A body that cannot sense its cells cannot retire the cells that have outlived their purpose. An enterprise is the same, and now it has agents acting on its behalf working at machine speed. Before you give them access to your systems, make sure your organization can feel what they can touch.
