TL;DR: Security teams can still miss compound exposure when data, identity, cloud and AI findings stay isolated, even if each signal is accurate, and says more than 20% of organisations reported AI-targeted breaches tied to surrounding system weaknesses, according to Securiti research. The real control gap is correlation, because toxic combination risk is invisible until permissions, data and workload context are analysed together.
At a glance
What this is: This whitepaper argues that a shared context layer is needed to connect data, identity, cloud and AI findings into one risk model, because isolated alerts can hide toxic combinations that no single tool can explain.
Why it matters: IAM, NHI and AI governance teams need correlated context to understand compound exposure, prioritise remediation and avoid treating linked permissions, data and workload issues as unrelated tickets.
By the numbers:
- More than 20% of organisations reported a breach targeting their AI models or applications.
Context
Enterprise security tools are often accurate in isolation but weak in combination. Data discovery, identity management, cloud posture and AI inventories can each surface real issues, yet they rarely explain how separate findings interact to create a larger exposure across identity security programme boundaries.
That gap matters because modern environments now blend permissions, sensitive data, cloud resources and AI systems into one operating surface. When teams cannot correlate those layers, breach-impact analysis slows, AI governance decisions stall, and the same environment can produce conflicting interpretations across security, privacy and governance functions.
Key questions
A: Teams should normalise findings into a shared context model before triage. The goal is not to replace specialist tools, but to understand how permissions, data and cloud or AI relationships combine into one exposure path. Without that step, each team can be right on its own data and still miss the larger risk that appears only when the findings are connected.
Q: Why do isolated security alerts often understate AI risk?
A: Because AI risk frequently sits in the systems around the model, not only in the model itself. Compromised APIs, plug-ins, cloud misconfigurations and overprivileged access can create the breach path, while a single alert rarely shows the full dependency chain. A connected view is needed to understand what the AI workload can reach and what it can expose.
Q: What are the signs that a security programme needs toxic combination detection?
A: The clearest sign is when multiple teams report accurate findings but disagree on the severity, priority or meaning of the same environment. That usually means the programme can see objects but not relationships. If medium-risk issues repeatedly turn out to be more serious when combined, the organisation needs correlation across identity, data, cloud and AI context.
Q: What should teams do when AI governance, privacy and security teams disagree on risk?
A: They should establish a common evidence model and a shared decision rule for linked findings. Disagreement usually means each function is reading a different slice of the environment. A context layer helps teams move from separate interpretations to one governed view of assets, permissions and exposures, which is essential for consistent AI deployment decisions.
Technical breakdown
Why isolated findings miss toxic combinations
A single-signal model treats each finding as self-contained, which is useful for detection but weak for governance. The problem is not that the alerts are wrong, but that they are incomplete when read separately. An overprivileged account, unclassified personal data and an unauthorized credential share may each look medium risk on their own, yet together they form a compound exposure path. Context layers resolve this by placing findings in a shared graph of assets, permissions and data relationships, so teams can see when independent issues converge into one exploitable condition.
Practical implication: Map cross-domain findings into a shared risk model before triage so compound exposure is assessed as one problem, not three tickets.
How a command graph changes AI and data governance
A command graph is a common model that links data, identity, cloud and AI assets into one view of relationships. It is not just inventory, because inventory lists objects while a graph explains dependency and permission context. For AI governance, that matters because model risk often sits in the surrounding systems, not only in the model itself. Compromised APIs, application plug-ins and cloud misconfigurations can create the breach path around AI workloads, while data and access links show what the workload can reach. The value is interpretive, not cosmetic: it turns scattered control evidence into decision-ready context. See the AI Security Maturity Model.
Practical implication: Use a relationship model to trace what an AI workload can reach, inherit and expose before approving broader deployment.
Why toxic combination detection outperforms single-signal alerting
Toxic combination detection looks for risk compounds rather than one-off anomalies. This approach is especially relevant in environments where no single issue is severe enough to trigger urgency, but the combination changes the threat posture materially. In practice, the detection logic has to correlate privilege, classification, access and workload context across silos, then score the relationship rather than the events individually. That is why this model is stronger for breach-impact analysis and AI adoption decisions: it surfaces the exposure path that traditional queue-based workflows miss.
Practical implication: Prioritise controls that score linked conditions across identity, data and cloud rather than relying on severity from one finding at a time.
Threat narrative
Attacker objective: Exploit disconnected control evidence to reach AI workloads, sensitive data or privileged access paths without triggering a complete risk picture.
- Entry occurs through weaknesses in surrounding systems such as compromised APIs, applications or plug-ins, or through cloud misconfigurations affecting AI workloads.
- Escalation emerges when a privileged account, unauthorized credential share and sensitive data access are evaluated separately rather than as one combined exposure.
- Impact is the hidden breach path that traditional alerting misses, because the full exposure only becomes visible once the related findings are correlated.
Breaches seen in the wild
- DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.
- Microsoft SAS token exposure 2023: An over-permissive Azure SAS token in a Microsoft AI GitHub repo exposed 38TB, including workstation backups and Teams messages, for 3 years.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Toxic combination risk is now a governance problem, not just a detection problem. Security teams already know how to find issues, but they still struggle to explain what those findings mean when combined across identity, cloud, data and AI. That shifts the control conversation from alert volume to relational context, because the exposure is often created by the interaction between otherwise ordinary findings. Practitioners should treat correlation as a core governance capability, not an optional analytics layer.
AI adoption fails when surrounding controls are evaluated in silos. The article's most important signal is that AI risk increasingly sits around the model, not only inside it. Compromised APIs, cloud misconfigurations and overprivileged access can determine whether AI systems are governable at all, which makes the boundary between AI security and IAM much thinner than many programmes assume. Teams that ignore that boundary will understate deployment risk and overestimate readiness. Practitioner conclusion: secure the connected control surface before scaling the AI workload.
Context layer security is the practical answer to fragmented governance. A context layer gives privacy, security and governance teams a shared way to interpret the same environment, which is why it reduces argument as much as it reduces risk. The distinctive concept here is toxic combination detection, meaning the identification of compound exposure that no single alert reveals. That model is especially relevant where cloud identity sprawl and AI acceleration meet. Practitioner conclusion: build decision-making around relationships, not isolated findings.
This whitepaper reinforces that identity is the connective tissue of Data+AI risk. An overprivileged account and an unauthorized credential are not separate hygiene issues when they sit in the same operational graph as sensitive data and AI workloads. The identity angle matters because permissions determine which data and systems an AI service can reach, which means IAM and NHI governance become part of AI governance by default. Practitioner conclusion: align access governance with data and AI context instead of treating it as a separate programme.
Shared context will become a baseline expectation for AI governance maturity. As organisations move from AI experimentation to operational deployment, disconnected inventories will stop being enough for risk decisions. The market direction is toward correlated evidence, where teams can explain not just what exists, but how it connects and what exposure those connections create. Practitioners should assume future AI governance reviews will ask for relationship evidence, not just point-in-time inventories.
From our research library:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Read next: Top 10 Cloud Security Risks
What this signals
Toxic combination detection: this is the shift from alerting on discrete issues to governing the exposure created when multiple weak signals align across data, identity and AI layers. The model matters because AI programmes fail fastest when teams cannot explain how one finding changes the meaning of another.
The programme implication is straightforward: AI governance needs a relational evidence trail, not just an inventory trail. When access, data and workload context are linked, security teams can decide whether an AI use case is actually deployable or only apparently safe.
According to the 2026 Infrastructure Identity Survey, organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious. That gap suggests confidence without context is not a maturity signal, it is a governance risk.
For practitioners
- Implement a shared risk graph Connect data, identity, cloud and AI findings into one model so teams can evaluate linked exposure instead of separate tickets.
- Prioritise toxic combinations over single alerts Escalate cases where overprivileged access, unclassified data and unauthorized credential sharing appear together, even if each finding is only medium severity.
- Use the context layer in breach-impact analysis Trace how an issue propagates across permissions, data and AI assets before deciding containment scope or notification impact. See the Generative AI Data Loss Prevention Guide.
- Align AI deployment reviews with identity governance Require evidence of access scope, workload reach and data classification before allowing AI systems to expand into sensitive environments.
Key takeaways
- The central issue is not that tools miss findings, but that isolated findings miss the compound exposure created when permissions, data and AI systems interact.
- More than 20% of organisations reported AI-targeted breaches, and the surrounding systems were the main weakness, which reinforces the need for correlated risk analysis.
- Security teams need a context layer that connects identity, cloud, data and AI evidence so they can prioritise toxic combinations instead of separate medium-severity tickets.
Related NHI Mgmt Group resources: Identity Security Programme Guide · Top 10 Cloud Security Risks · AI Security Maturity Model · Generative AI Data Loss Prevention Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article links AI risk to privileged access and contextual governance across AI systems. |
| Recommendation — Map AI access paths to ASI03 and require privilege context before approving deployment. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The whitepaper is fundamentally about governance structures that connect AI risk evidence. |
| Recommendation — Establish governance rules that correlate AI, identity and data evidence before risk decisions. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article focuses on how organisations define and prioritise risk across multiple security domains. |
| Recommendation — Adopt a risk strategy that scores linked findings instead of treating each control domain separately. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Identity permissions are part of the combined exposure model described in the whitepaper. |
| Recommendation — Use IAM controls to limit the access relationships that feed compound AI and data exposure. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article's breach-path discussion centers on credential and access abuse across connected systems. |
| Recommendation — Map correlated exposure to credential access and lateral movement tactics in your detection pipeline. | ||
Key terms
- Context Layer: A context layer is the connective information that turns isolated data findings into actionable security intelligence. It correlates ownership, access, policy, movement, and regulatory exposure so teams can decide what to remediate, review, or restrict without manually stitching together separate tool outputs.
- Toxic Combination Detection: Toxic combination detection is the practice of identifying risk that only becomes meaningful when multiple findings are evaluated together. It is especially useful when each issue looks moderate on its own but becomes materially more dangerous when linked through shared permissions, data access or workload reach.
- Command Graph: A command graph is a relationship model that connects assets, identities, permissions and data into one navigable view. Unlike a simple inventory, it shows how systems interact, which makes it useful for impact analysis, governance decisions and spotting exposure chains across AI and cloud environments.
- Shared Risk Map: A common view of assets, exposures, business services, and ownership used by GRC and security operations to make the same risk decisions. It reduces translation errors between business language and technical language and supports consistent prioritisation.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is a practical way to strengthen the governance skills that underpin connected risk management across modern environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org