AI insider risk is becoming a governance problem, not theft

At a glance

What this is: Proofpoint says AI assistants and autonomous workflows are turning insider risk into a trusted-actions problem because authorised systems can now gather and reshape sensitive data without the familiar signs of manual theft.

Why it matters: IAM, NHI, and PAM teams need to govern what can act with trusted authority, because permissions, delegation, and output controls now matter as much as user monitoring.

Context

AI insider risk is no longer only about a person moving data out of the business. The governance gap is that trusted access now sits behind AI assistants, workflow automation, service identities, and connected enterprise data sources that can act faster than traditional insider controls were designed to observe.

In practical terms, the issue is not just visibility into users. It is visibility into what can search, combine, transform, and disclose data inside the control boundary, especially when the actor inherits permissions that were never intended to become machine-scale discovery rights.

Key questions

Q: What breaks when an AI assistant can access private data and untrusted content at the same time?

A: When an assistant can access private data and ingest untrusted content, a small injected instruction can become a data-exfiltration path. The usual assumption that content is passive fails, because the model can interpret it as an operational command and move it into tool execution.

Q: Why do autonomous AI agents increase insider risk even when access is technically authorized?

A: Autonomous agents increase insider risk because authorization alone does not explain purpose. A headless agent can inherit legitimate access and still move data, trigger workflows, or expose information in ways humans never intended. Risk rises when security teams cannot see the action’s context, intended outcome, and data sensitivity together.

Q: What are the signs that insider threat analytics are failing in an AI-enabled environment?

A: A common sign is that detections for bulk repository access are either generating constant alerts or have been tuned down until they rarely fire. Another indicator is when teams treat machine-speed bursts as normal because the same account now behaves like a user and an agent at once. That is a signal the baseline no longer matches reality.

Q: Should organisations separate insider risk, IAM, and AI governance?

A: No. The article shows they are the same governance problem seen through different lenses. Insider risk manages trusted behaviour, IAM governs who or what has authority, and AI governance constrains delegated action. Splitting them creates blind spots because the control failures move across teams while the risk remains connected.

Technical breakdown

Trusted action replaces manual exfiltration

Classic insider monitoring assumes a human must collect, stage, and move data to create a theft signal. AI assistants compress that sequence into one request: query, retrieve, summarise, and output. That matters because the control boundary shifts from detecting suspicious movement to governing authorised access paths and output generation. In other words, the actor may never touch the original document in a way the user notices, yet the system still discloses sensitive content through legitimate functions.

Practical implication: Treat output generation as a governed control point, not just file transfer or download activity.

Shadow AI and inherited permissions

The article describes shadow AI, user-inherited permissions, service identities, and chained API calls as the practical mechanics behind this change. The real risk is not that AI has intent, but that it executes within broad access scopes accumulated through convenience-driven sharing. When collaboration sprawl and inherited access rights persist, an AI system can surface information that no one intended to expose, even though every individual permission check appears valid.

Practical implication: Map AI access to the underlying permissions and connectors it inherits, then challenge every default scope.

Intent becomes observable earlier in the workflow

A prompt can reveal purpose before downstream data movement happens, which changes how insider risk can be analysed. Traditional signals such as unusual downloads or bulk exports were often the first visible evidence of misuse. With AI, the request itself may be the most important governance artefact because it describes the target, objective, and expected outcome in one interaction. That creates a new layer for data security, identity governance, and insider risk programmes to correlate.

Practical implication: Log and review prompts, retrieval context, and resulting outputs as part of the same governance event.

Threat narrative

Attacker objective: Extract sensitive strategic and commercial information through a trusted workflow that appears to be ordinary productivity.

1. A user submits a high-value prompt to an enterprise AI assistant asking for roadmap, pricing, account, renewal, and competitive information. The assistant then searches repositories, collaboration tools, and connected sources within its authorised scope.
2. The assistant aggregates data from multiple systems, inherits permissions that exceed the need for a single task, and returns a concise executive-style summary. No manual file staging or bulk download is required.
3. The resulting output exposes sensitive business information through a legitimate-looking productivity workflow, making the incident difficult for traditional insider monitoring to classify as theft.
4. The attacker objective is to extract sensitive strategic and commercial information through trusted access paths while avoiding the signals associated with manual exfiltration.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
• Coinbase insider bribery breach 2025: Criminals bribed overseas Coinbase support agents to copy data on 69,461 customers, then tried to extort $20 million.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted action is now the unit of insider risk: The old insider model centred on a person moving files out of the business. That model fails when AI assistants can search, aggregate, transform, and disclose sensitive content inside legitimate workflows. The governance question is no longer only who has access, but what can act with trusted authority, and that change rewires how insider risk must be measured and controlled.

Permissions have become the hidden insider surface: AI does not create access sprawl, but it makes sprawl operationally dangerous. Years of convenience-driven collaboration left many environments with broad repository, workspace, and inherited access that humans may ignore but machines will not. The implication is that permission governance now determines the blast radius of AI-enabled insider exposure.

Shadow AI collapses the boundary between user behaviour and system behaviour: Browser tools, plugins, desktop assistants, SaaS copilots, and agentic workflows can all act outside established governance processes. That creates an identity problem as much as a data problem because delegated authority is being exercised without a reliable inventory of actors, scopes, or offboarding points. Practitioners need one governance model for humans, service identities, and AI-mediated actions.

Intent has become an early governance signal: A prompt can contain the objective, target, and outcome before any data movement occurs. That makes prompt context a governance artefact, not just a user interaction. The implication is that insider risk programmes must move from after-the-fact behaviour review to pre-action intent correlation across identity, access, and data.

Governance of trusted actions should replace fragmented program boundaries: Insider risk, data security, IAM, and AI governance now describe the same operational problem from different angles. The article is right to collapse them into one conversation because the control failure is shared. Practitioners should treat that convergence as a programme design issue, not an additive tool problem.

What this signals

Trusted actions need their own control plane: Organisations should stop assuming that user monitoring alone will surface AI-enabled misuse. When a system can search, summarise, and disclose data on behalf of a user, the decisive question becomes which actions are authorised, observable, and revocable across the whole delegation chain.

The practical shift is toward governance that spans identity, data, and runtime behaviour. That means prompt context, connected sources, inherited permissions, and generated output all belong in the same review conversation, because the risk is created by their combination rather than any single component.

For practitioners

• Inventory trusted actors and delegated paths Build a single inventory of humans, service identities, AI assistants, autonomous workflows, and the repositories or applications they can reach. Include chained API calls and browser-based tools so the effective authority of each actor is visible.
• Review permissions from an AI execution perspective Test which prompts or tasks would surface sensitive content across overshared workspaces, inherited access rights, and collaborative repositories. Focus on what the AI can discover and assemble, not just what a human would likely open.
• Add prompt and output governance to insider controls Treat prompt text, retrieved context, and generated output as security-relevant events. Correlate them with identity and access logs so the organisation can distinguish legitimate productivity from unauthorised sensitive disclosure.
• Collapse insider risk and AI governance into one operating model Align data security, identity governance, and insider risk teams around trusted actions rather than separate alert queues. The operating model should answer what can act, what it can reach, and what it can reveal under delegated authority.
• Harden shadow AI discovery and containment Use discovery controls to identify browser tools, plugins, desktop applications, and SaaS copilots operating outside approved processes. Where discovery shows unmanaged access paths, restrict connected data sources before those paths become routine.

Key takeaways

• AI assistants change insider risk from visible data movement to trusted information retrieval and disclosure inside normal workflows.
• Broad inherited permissions and unmanaged shadow AI create the conditions for sensitive data exposure without the classic signs of theft.
• Security teams need one operating model that links identity, access, and data controls to prompts, outputs, and delegated authority.

Key terms

• Trusted Action: A trusted action is any data access, decision, or output produced by an actor operating inside an organisation's control boundary. For AI systems, the risk is not only who logged in, but what the system can do with legitimate access once it starts combining data and generating results.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
• Prompt Context: Prompt context is the text and surrounding instructions that define what an AI system is being asked to do. In governance terms, it can become an early signal of intent because it often reveals the target, objective, and desired output before any data movement occurs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.