TL;DR: 2026 will bring bigger AI-driven attacks, a more operational AI SOC, and a wider attack surface from shadow AI and agentic IAM, while hybrid campaigns keep blending identity abuse, cloud compromise, and automation, according to Vectra AI. The old assumption that security operates on human-paced trust and review cycles is breaking down.
At a glance
What this is: Vectra AI’s 2026 outlook says AI-powered offense, AI-enabled SOC workflows, and shadow AI will reshape identity and detection priorities.
Why it matters: It matters because identity teams now have to govern human, machine, and agent behaviour across tool access, observability, and response speed rather than treating AI as a side issue.
By the numbers:
- 46% of organisations plan to start using AI agents in security operations in 2026, according to Gartner’s 2025 Cybersecurity Innovations survey cited by Vectra AI.
- The article points to CVE-2025-14847 as the MongoBleed alert that kicked off security response over the 2026 holiday period.
Context
AI is no longer just a model layer in security programmes. It is becoming part of the operating fabric for detection, triage, investigation, and even action, which means identity, governance, and control boundaries are all being redefined at once.
The problem is not simply more automation. It is that autonomous and semi-autonomous systems are now being connected to live security data and tools faster than governance models can define ownership, auditability, and acceptable scope.
Key questions
Q: What should security teams do when AI agents need access to tools and data?
A: Security teams should treat AI agents as runtime access actors and separate them from static machine identities. Limit tool scope, define approval gates, and require explicit revocation triggers for sessions and delegated access. The goal is to prevent broad runtime behaviour from inheriting static privileges.
Q: Why do shadow AI tools create more identity risk than ordinary application sprawl?
A: Shadow AI often brings hidden identity relationships with it, such as OAuth grants, embedded secrets, and delegated API permissions. Those connections can create durable access to data and workflows even when the application itself looks harmless. The risk is not just the tool, but the ungoverned entitlement path behind it.
Q: Should SOC teams use AI agents for investigation before response?
A: Yes, but only if investigation authority is tightly bounded and response authority remains separately controlled. Investigation is where AI can add speed and consistency, but response actions need stronger approval gates, clearer rollback, and more restrictive permissions. The safest pattern is to expand autonomy gradually, starting with evidence collection and triage.
Q: What does hybrid identity abuse mean for detection and response programmes?
A: It means defenders can no longer rely on separate views of cloud, endpoint, and identity activity. The response model has to correlate those signals into one attack narrative, or hybrid campaigns will keep slipping through the seams between teams and tools.
Technical breakdown
Why agentic SOC architectures change identity governance
Agentic SOC tooling connects models or agents to security platforms, live telemetry, and response workflows through programmatic interfaces such as MCP. That changes the identity problem from “who can log in” to “what can an agent query, infer, and trigger.” Once an agent can call tools directly, the security model has to govern delegated authority, action scope, and traceability at runtime. The governance question is no longer whether automation can help analysts, but whether the agent’s permissions, data access, and tool calls are tightly bounded enough to avoid uncontrolled action paths. See the AI Agent Authorisation Guide.
Practical implication: Treat agent identities as governed executors, not assistants, and define explicit tool scope before any production use.
How shadow AI expands the attack surface
Shadow AI is unmanaged AI use that sits outside security visibility, ownership, or policy. In practice, employees may deploy copilots, local agents, or third-party AI workflows that touch data, make decisions, or move information without any central inventory. That makes identity boundary setting harder, because the organisation may not know which systems act on behalf of users, what those systems can reach, or how far their privileges extend. The result is an attack surface that includes not only the application but also the hidden identity and access relationships around it. See the Identity Governance for AI Agents Guide.
Practical implication: Inventory AI systems by identity and access path, not just by application name or business function.
What hybrid attacks reveal about identity and telemetry
Hybrid attacks blend identity abuse, cloud compromise, malware, and fraud-style tactics into one campaign. That matters because no single control plane sees the whole chain unless telemetry is stitched across endpoint, cloud, identity, and collaboration systems. The article’s point is not that attackers are new, but that the boundary assumptions between tools and teams are now the defensive weakness. Once credentials, tokens, and trusted sessions are reused across environments, the attack path becomes one continuous movement problem rather than separate incidents.
Practical implication: Correlate identity signals across cloud, endpoint, and collaboration systems so campaign detection is not trapped inside one silo.
Threat narrative
Attacker objective: The attacker aims to move faster, blend into normal activity, and expand the blast radius across identity, cloud, and operational systems before defenders can coordinate a response.
- Entry begins with AI-assisted and hybrid intrusion methods that lower the skill barrier and increase the speed of initial access and follow-on action.
- Escalation comes from identity abuse, tool chaining, and agentic workflows that can move through environments faster than human review cycles.
- Impact is achieved when adversaries combine cloud compromise, exfiltration, and extortion or when hidden AI use creates unmanaged data movement and decision paths.
Breaches seen in the wild
- MongoBleed breach: MongoBleed exposed secrets across 87K MongoDB servers.
- Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
2026 will be defined by governance lag, not just attack innovation: the gap is no longer whether AI can participate in security operations, but whether programmes can define ownership, permission boundaries, and auditability fast enough for machines that act at runtime. That makes the control problem architectural rather than merely operational. The practical conclusion is that identity teams must govern agent behaviour as a first-class security domain.
The old review cycle assumption is already collapsing: access review processes were designed for privileges that persist long enough to be observed, certified, and revoked. Autonomous or agentic systems can request, use, and discard access inside a short execution window, which means the control premise itself no longer holds. The implication is that governance has to move toward issuance-time control and traceability, not retrospective review alone.
Shadow AI is an identity inventory problem before it is a data problem: organisations cannot secure what they have not enumerated, and hidden AI workflows create unowned identities, untracked permissions, and invisible data paths. Identity governance for AI agents becomes relevant because the critical failure is not the model, but the absence of lifecycle ownership around the thing acting on behalf of the user. Practitioners should treat unmanaged AI as a governance blind spot, not a novelty.
Hybrid attack defence now depends on collapsing tool silos: attackers see one continuous environment, while most defenders still organise evidence by function, team, or product. That mismatch lets identity abuse, cloud compromise, and malware unfold across different control planes without a shared narrative. The practical conclusion is that detection and response must be unified across identity, endpoint, cloud, and collaboration telemetry.
From our research library:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Read next: Identity Governance for AI Agents Guide
What this signals
Agentic governance will become a programme boundary, not a feature request: once agents can query live systems and trigger responses, security teams need a distinct control model for delegated action, not just another automation policy. The most useful next step is to govern the identity of the actor, not just the application it sits inside.
Unmanaged AI will surface through control failures before it shows up in board reporting: the first signs are usually missing ownership, weak audit trails, and permissions that no one can explain in plain language. That is why the right programme response is to inventory and govern AI identities, not to wait for a maturity exercise.
Visibility across identity and telemetry is becoming the decisive defensive capability: attackers are already blending access abuse, cloud movement, and disguised automation across domains. Once that happens, the only durable defence is a programme that can reconstruct a full campaign from a single thread of identity evidence.
For practitioners
- Map AI agent permissions before production use Document every tool, dataset, and action path an agent can reach, then compare that scope with the business task it is meant to perform.
- Create an inventory of shadow AI and agentic workflows List approved and unapproved AI systems by owner, data access, and delegated action so hidden automation cannot bypass governance.
- Correlate identity telemetry across control planes Join identity, endpoint, cloud, and collaboration signals so abuse patterns can be reconstructed as one campaign instead of separate alerts.
- Test whether your SOC can audit agent actions Verify that tool calls, approvals, and data accesses are attributable end to end, including where an AI workflow acts without direct human supervision.
Key takeaways
- AI-driven security operations are no longer hypothetical, but their governance model is still immature relative to the pace of deployment.
- Shadow AI turns unmanaged automation into a visibility and accountability problem that traditional IAM inventories will miss.
- Detection and response programmes now need unified identity telemetry across cloud, endpoint, and collaboration systems to keep pace with hybrid attacks.
Related NHI Mgmt Group resources: Identity Governance for AI Agents Guide · AI Agent Authorisation Guide · AI SOC Guide · SOC Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centers on agent permissions, runtime action scope, and governance for AI systems acting through tools. |
| ASI02 — Tool Misuse | Tool calls, MCP access, and action triggering are central to the SOC agent risk described here. | |
| Recommendation — Apply ASI03 to bound agent authority, audit tool use, and prevent privilege from expanding beyond task scope. Constrain agent tool access so every external action is authorized, logged, and limited to the intended workflow. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Agent and machine access to security data depends on trustworthy authentication and delegated access controls. |
| NHI-05 — Overprivileged NHI | The post repeatedly warns that AI agents are being granted too much access too early. | |
| Recommendation — Strengthen authentication for non-human actors so agent sessions and service access cannot be abused or silently reused. Reduce non-human privilege to the smallest task scope and remove standing permissions that agents do not need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article’s governance concerns map directly to entitlement control for agent and service access. |
| Recommendation — Review and limit permissions for AI agents and shadow AI workflows under PR.AA-05. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article highlights credential abuse, hybrid movement, and campaign chaining across environments. |
| Recommendation — Map hybrid intrusions to credential access and lateral movement so detection covers the full campaign path. | ||
Key terms
- Agentic Soc: An agentic SOC is a security operations model where AI systems assist with triage, investigation, and response using tool access and execution authority. The control challenge is not just accuracy, but governance of what the machine can see, decide, and do.
- Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
- Agentic IAM: Agentic IAM is identity and access management designed for environments where AI agents make independent decisions and take actions. It combines authentication, authorization, delegation, monitoring, and revocation so agent autonomy is constrained by policy, context, and accountability rather than open-ended system trust.
- Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org