AI security risk assessments are rising, but continuous control still lags

At a glance

What this is: This analysis says AI security risk is rising faster than governance maturity, with assessments increasing but still failing to keep pace with changing models, integrations, and agents.

Why it matters: For IAM, NHI, and AI security teams, the lesson is that launch-time review does not control runtime change, especially when agents gain permissions and systems evolve after approval.

By the numbers:

• 87% of organisations say AI-related vulnerabilities increased over the past year.
• AI security risk assessments have nearly doubled, rising from roughly 37% to 64% of organisations in a single year.

Context

AI security governance is shifting from a narrow model-risk conversation to an operational control problem. Once AI systems connect to data, APIs, and other services, their security posture changes after deployment, not just at approval time. That is why assessment frequency, permission scope, and post-deployment monitoring matter as much as initial review.

The article’s underlying governance gap is familiar to identity practitioners: controls built for static systems struggle when the subject keeps changing. In AI and agentic environments, that means standing assumptions about access, tool use, and data exposure can become stale quickly unless review is continuous.

Key questions

Q: How should security teams govern AI systems that can act without human approval?

A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review. That means tightly scoping tools, data, and actions; logging every material step; and making revocation and containment available while the session is still active. Static policy alone does not control machine-paced execution.

Q: Why do AI agents create new privilege risk for enterprises?

A: AI agents can chain actions across tools, inherit delegated access, and execute at machine speed without a person confirming each step. That creates a privilege problem when task scope is not tightly bounded. The main risk is not only misuse, but over-authorization that lets one agent action become a wider system compromise.

Q: What are the signs that AI security investments are not keeping pace with current threat conditions?

A: Common warning signs include heavy dependence on manual investigation, slow incident response, weak bot detection, and a security programme that cannot adapt as attack methods evolve. If teams still rely mainly on legacy controls and struggle to operationalise threat data, AI is not yet improving resilience. Rising threat sophistication should be matched by measurable gains in speed, coverage, and automation.

Q: What is the difference between human IAM and agentic AI governance?

A: Human IAM is built around users, sessions, and relatively predictable access patterns. Agentic AI governance must also control memory, delegation, and machine-speed actions that can continue after the original request is made. That means identity policy has to follow the task lifecycle, not just the login event, and must cover both authorization and state handling.

Technical breakdown

Why AI risk assessments fail when systems keep changing

An AI security assessment captures a snapshot of model behaviour, data exposure, permissions, and integration risk at a point in time. That works poorly when the system is retrained, reconfigured, connected to new tools, or wrapped in an agent layer after the review is complete. The control problem is not the assessment itself, but the assumption that the system remains the same after approval. In practice, the attack surface shifts with every prompt path, connector, and permission change. For identity teams, the parallel is clear: authorisation must be governed as a living state, not a static sign-off.

Practical implication: Treat AI review as a control state that must be revalidated whenever permissions, data sources, or agent behaviour change.

How AI agents change the identity and privilege model

AI agents are not just chat interfaces. They can invoke tools, query systems, move data, and act at machine speed, which means they operate like non-human identities with dynamic privilege needs. Traditional IAM assumes a person or service account has a reasonably stable role, but agentic behaviour can expand or contract within a session or task. That creates a governance gap around authorisation, delegation, and oversight. The security issue is not only what the model says, but what the agent can do with the access it is given. This is where NHI governance becomes directly relevant to AI.

Practical implication: Model agents as governed non-human identities and review their permissions with the same rigor applied to service accounts and workloads.

Why over-privileged AI access becomes an escalation path

The article highlights over-privileged access as a core AI risk because tools, plugins, and downstream systems extend the blast radius of any compromised or misbehaving model. When an AI system has access to sensitive systems, a prompt injection, design flaw, or malicious instruction can turn a limited error into data exposure or unintended action. This is not a new security pattern, but AI compresses the time between manipulation and impact. The important distinction is that privilege is now attached to a system that can change behaviour without a new deployment cycle. That weakens traditional approval gates.

Practical implication: Reduce AI privilege to the minimum required for each task and separate read, write, and tool-use permissions wherever possible.

Threat narrative

Attacker objective: Exploit AI and agent permissions to trigger data exposure, workflow abuse, or broad downstream impact without being stopped by one-time review.

1. Entry occurs through normal deployment, integration, or agent onboarding, where the AI system is granted access to data, tools, or downstream services.
2. Credential or privilege abuse follows when prompts, connectors, or agent workflows allow the system to operate with more access than the task requires.
3. Impact appears as data leakage, manipulated outputs, or scaled misuse of connected systems when the AI layer is no longer governed continuously.

Breaches seen in the wild

• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
• Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static AI assessments are becoming a governance anti-pattern: a point-in-time review cannot keep pace with systems that retrain, reconfigure, and expand their integrations after approval. The article shows the market is recognising risk faster than it is operationalising control. For identity and security leaders, the lesson is to treat AI governance as a continuous state rather than a launch checklist.

AI agents make non-human identity governance unavoidable: once a system can query services, move data, and invoke tools, it is operating inside an access model, not just a model-risk model. That means the discipline of NHI governance now overlaps directly with AI security. Practitioners should assume that agent permissions, delegation, and lifecycle control are part of the security design, not a later add-on.

Over-privilege is the named failure mode this article exposes: AI systems become dangerous when permissions outgrow the task and no continuous control closes the gap. The governance assumption that access granted at deployment remains acceptable during runtime is the mistake. In practice, this means security teams need policy boundaries that follow the agent’s actual behaviour, not just its intended use.

Continuous control, not more paperwork, is the real maturity signal: organisations that only increase the number of assessments can still miss behaviour drift, new integrations, and privilege expansion. The article’s deeper implication is that resilience comes from linking review, telemetry, and access control into one operational loop. That is now a baseline expectation for AI governance programmes.

AI risk is now a shared identity, data, and security problem: the controls that fail are often the seams between teams, not a single missing safeguard. Security, IAM, and AI governance must align on who owns permissions, who approves change, and who detects drift. Practitioners should build joint governance around the runtime state of AI systems, not the vendor assurance pack.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.

What this signals

Continuous AI control is the real maturity threshold: the industry is moving past simple assessment counts and toward whether governance can follow system change in real time. For practitioners, that means the question is no longer whether AI has been reviewed, but whether review, permissioning, and monitoring stay linked after deployment.

Agentic AI forces identity teams into the control plane: once AI systems can act, the security model must account for machine identity, delegation, and task-scoped authorisation. That makes AI governance a practical extension of NHI and IAM discipline, not a separate conversation.

Assessment without runtime telemetry creates false confidence: a one-time sign-off can coexist with new connectors, broader access, and behaviour drift. Security teams should expect the next wave of AI incidents to come from control gaps between approval and operation, not from a lack of policy documents.

For practitioners

• Define AI systems as governed identities Create a classification for AI systems and agents that captures owner, purpose, data access, tool access, and approval scope. Use that record as the basis for review, recertification, and exception handling.
• Move from one-time review to continuous validation Trigger reassessment when models are retrained, connectors change, prompts are updated, or new privileges are added. A static approval should expire when the system materially changes.
• Separate task access from standing access Use least-privilege boundaries for read, write, and tool invocation so an agent cannot accumulate broad access by default. Review whether any AI workflow still needs persistent credentials or broad API scope.
• Monitor for privilege drift and behaviour drift Correlate identity telemetry, tool calls, and data access patterns so you can spot when an AI system is acting outside its approved workflow. Drift detection should be part of the operating model, not an afterthought.

Key takeaways

• AI risk is increasing because the systems themselves keep changing after approval, while many governance processes still assume a static state.
• The rise in assessments is useful, but it does not close the gap between review time and runtime change across models, agents, and integrations.
• Practitioners need continuous control, privilege scoping, and ownership for AI systems if they want governance to keep up with real-world behaviour.

Key terms

• Continuous AI Control: A governance model that treats AI security as a living process rather than a one-time approval. It ties review, monitoring, and permission changes together so the system is rechecked whenever models, connectors, or agent behaviour changes.
• Agentic Identity Drift: Agentic identity drift is the divergence between the access an AI agent was approved to have and the behaviour it exhibits at runtime. It appears when tool use, delegation, model updates, or new integrations expand effective access beyond the original governance boundary.
• Non-Human Identity Governance: Non-human identity governance is the practice of managing, controlling, and auditing every machine identity across its full lifecycle. It covers service accounts, API keys, tokens, certificates, and AI agent credentials, ensuring each has a defined owner, scoped privilege, rotation schedule, and revocation path. Without governance, NHIs accumulate silently and become the primary attack surface in cloud and automated environments.
• AI Privilege Spectrum: The AI privilege spectrum is the idea that an identity’s risk cannot be reduced to privileged or not privileged. For AI systems, effective privilege shifts as the actor discovers new paths, inherits permissions, and reaches additional tools or data during execution.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the systems and access paths that now define AI risk.