AI is transforming data from a supporting asset into the “center of power” of all digital systems. However, as AI increasingly exploits data in deeper and more continuous ways, the boundary between value and risk is becoming increasingly fragile. Threats have evolved from data theft to the manipulation of training data, exploitation of model vulnerabilities, and the use of AI to automate large-scale attacks—at a speed far beyond human response capabilities. In Vietnam, 2025 recorded more than 552,000 cyberattacks, with 52.3% of organizations affected, while the Personal Data Protection Law (Law No. 91/2025/QH15), effective from January 1, 2026, introduces urgent new compliance requirements.

In this context, traditional security approaches—built around perimeter-based defenses—are showing clear limitations. As the lifecycle of data and AI models becomes increasingly distributed, complex, and difficult to control, security can no longer function as a reactive layer. Instead, it must be embedded across the entire data lifecycle, from collection and processing to training, utilization, and sharing.

Drawing on real-world implementation experience, we propose a comprehensive approach to data security based on the “Security & Privacy-by-Design” principle: dynamic access control for both users and AI agents, continuous monitoring, and leveraging AI itself as a defensive tool to detect, predict, and respond at machine speed. This approach is reinforced by Cyber Resilience—a philosophy that goes beyond prevention to ensure sustained operations even under attack—combined with human capability development and compliance with the Personal Data Protection Law. Together, these form the foundation for organizations to harness AI in a controlled, sustainable manner while ensuring data security and sovereignty in the digital era.