AI is forcing a new cyber resilience operating model

At a glance

What this is: This is Horizons.ai's analysis of how AI is changing cyber resilience, arguing that defenders now need evidence of exploitability and remediation impact rather than more visibility alone.

Why it matters: This matters to IAM practitioners because AI-driven attack speed changes how identity, access, and privileged exposure must be validated, especially where machine identities and delegated access expand blast radius.

By the numbers:

• The ECB directed every significant institution under its supervision to submit a comprehensive action plan by October 31, 2026.

Context

Cyber resilience has traditionally depended on enough time to discover, assess, patch, and verify before an attacker could exploit exposure. AI breaks that timing assumption by compressing the interval between vulnerability discovery and weaponisation, which means security teams need evidence about what is actually exploitable rather than broad inventories of what exists.

The identity angle is indirect but real. When attack speed increases, standing access, stale privileges, over-broad service accounts, and weak validation of delegated access all become harder to justify because they extend the window in which exploitation can succeed. In that sense, the article is about resilience, but the control implications reach directly into IAM, PAM, and machine identity governance.

Key questions

Q: How should security teams adapt resilience programmes when AI shortens the exploit window?

A: They should move from periodic assurance to continuous evidence generation. The priority is proving what is actually exploitable, what business impact it could create, and whether remediation removed the attack path. That means validating exposures in context, refreshing evidence as systems change, and treating verification as an operational control rather than a reporting step.

Q: Why do AI-enabled attacks change the value of traditional vulnerability management?

A: They reduce attacker cost and speed up reconnaissance, phishing, and exploitation, which means the defender’s old timeline no longer fits the threat. Traditional vulnerability management assumes enough time to discover, assess, approve, and patch. AI collapses that margin, so prioritisation must move from static severity to active exposure.

Q: Where do identity controls fail when cyber operations speed up?

A: They fail when access governance assumes there will be time to review privileges after they are granted. Standing access, stale entitlements, and weak validation of delegated credentials can all remain in place long enough for AI-assisted attackers to use them. Runtime validation and tighter lifecycle control are therefore essential.

Q: What should regulated institutions evidence to supervisors about AI-driven cyber risk?

A: They should show what was exploitable, how remediation changed the attack path, and how they know the risk reduction is real. Supervisors are increasingly looking for proof that controls reduce operational risk under current threat conditions, not just evidence that the controls exist on paper.

Technical breakdown

Why AI compresses the exploit window

AI changes the economics of offensive tradecraft by accelerating vulnerability discovery, exploit generation, attack chaining, and repeated testing at scale. That does not create a new class of weakness, but it shortens the time between exposure and exploitation so dramatically that periodic assessment becomes less reliable as a control model. In practice, this means the defender’s problem is no longer simply finding issues faster. It is proving which issues can be turned into working attack paths inside the real environment before adversaries do. That is an evidence problem, not a scanning problem.

Practical implication: treat validation of exploitability as a control objective, not a post-assessment reporting task.

Why visibility is no longer enough for resilience

Visibility tells you that an asset, credential, or configuration exists. Evidence tells you whether it can be used to cause harm under current conditions. The article’s central distinction is that modern resilience requires proof of impact, not just identification of exposure. This is especially important where identities and privileges are concerned, because access may be technically present but operationally constrained, or it may look benign until chained with another weakness. Security programmes therefore need mechanisms that continuously confirm whether exposure still translates into risk.

Practical implication: build assurance around exploitability, blast radius, and remediation verification rather than inventory counts alone.

How evidence-based security changes operating rhythms

Evidence-based security replaces periodic certainty with continuously refreshed decision support. Instead of assuming controls work because they were deployed, teams must repeatedly verify that remediation actually eliminated the attack path and that the environment has not reintroduced the same weakness through drift. That pattern matters for identity governance because privileges, tokens, service accounts, and delegated access can change faster than formal review cycles. Where access is ephemeral or machine-mediated, the control has to operate at issuance and verification time, not only during scheduled review cycles.

Practical implication: move identity and exposure checks closer to runtime so privileges are validated when they matter.

Threat narrative

Attacker objective: The attacker objective is to turn exposed weaknesses into working compromise faster than defenders can validate and remediate them.

1. AI-enabled discovery reduces the time needed to identify exploitable weaknesses and assemble attack chains at scale.
2. Attackers then test and weaponise those weaknesses before defenders can complete traditional assess-and-patch cycles.
3. The impact is a narrower defender window in which exposed systems, access paths, and chained vulnerabilities remain safe.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Evidence, not visibility, is becoming the controlling concept in cyber resilience. Security programmes built around inventories and periodic reviews cannot keep pace when attackers can validate exploitation paths in minutes. The decisive question is no longer what exists, but what can be proven exploitable right now. Practitioners should therefore shift governance from reportable coverage to demonstrable risk reduction.

Machine speed exposes the limits of scheduled control cycles. Access reviews, patch windows, and quarterly assurance assumptions all depend on time that AI-enabled attackers can erase. That makes runtime validation more important than retrospective certification, especially for credentials, privileged access, and machine identities. Teams should treat shortened decision windows as a governance issue, not only an operational one.

The ECB letter signals a broader resilience reset across regulated sectors. Regulatory expectations are moving toward proof that controls reduce risk under current attack conditions, not proof that controls merely exist. That aligns with frameworks such as DORA and NIST CSF 2.0, but it also sharpens the case for identity governance where access scope, delegation, and credential lifecycle determine how much damage an attacker can do. Practitioners should expect audit conversations to shift from policy coverage to evidence quality.

AI creates an evidence gap that identity programmes are well positioned to close. If defenders cannot prove which access paths are exploitable, they cannot prove which identities are safe to leave standing. That is why NHI governance and PAM are becoming resilience controls, not just access controls. The practitioner conclusion is clear: validate entitlement risk continuously, or the attack window will define your operating model for you.

Continuous verification is the new resilience baseline. AI has turned elapsed time into an adversary advantage, so security governance has to reward proof of impact reduction rather than activity completion. For identity teams, that means access must be assessed in context, at the moment it can be used, not only when reviews are scheduled.

What this signals

AI-driven resilience is pushing security governance toward proof at the moment of risk. Annual reviews and static assurance models are too slow when exploitability can change between assessment cycles. The operating model now has to answer what is exploitable, what is safe to leave standing, and what evidence supports that decision.

Identity governance inherits the same speed problem. If access decisions are not validated close to issuance and change events, standing privileges can outlive the evidence that justified them. For NHI and PAM teams, that makes lifecycle control part of resilience rather than a separate admin function.

For practitioners

• Implement evidence-based validation loops Replace assumption-based reporting with repeated checks that show whether a weakness is actually exploitable in the current environment.
• Prioritise exploitability over inventory completeness Use risk context to rank exposures that can be chained into real attack paths, not merely those that appear in a scan or asset list.
• Shorten the verification window for identities and privileges Move access validation closer to issuance and change events so standing access does not persist long enough to become an exploitable path.
• Test remediation for outcome, not activity Confirm that patching, hardening, or access changes remove the actual attack path and do not just satisfy a checklist entry.
• Align resilience reporting to regulator-ready evidence Prepare board and supervisory updates that show proven risk reduction, including what was exploitable, what changed, and what remains verified.

Key takeaways

• AI changes cyber resilience by shrinking the time defenders have to prove that exposure is not exploitable.
• The article argues that evidence of risk reduction matters more than lists of vulnerabilities or controls.
• For practitioners, the immediate shift is toward continuous validation of impact, remediation, and access scope.

Key terms

• Evidence-based security operating model: A security operating model that makes decisions from current, testable proof rather than assumptions, schedules, or broad visibility alone. It focuses on whether a weakness is exploitable, what business path it creates, and whether remediation actually removed the attack path. That makes risk management faster and more defensible.
• Exploitability context: Exploitability context is the evidence used to decide whether a vulnerability matters in a specific environment. It includes reachability, code path exposure, compensating controls, and product-specific advisories, and it turns raw scan data into a decision that can be defended.
• Operational Resilience: Operational resilience is the ability to keep critical services running or recover them quickly after disruption. In identity-led environments, that depends on authentication services, privilege management, and recovery procedures that can be tested under realistic failure conditions.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners build the control discipline needed for modern access risk.