TL;DR: AI-assisted attack methods and software velocity have made periodic assessments and perimeter controls insufficient, pushing security toward always-on validation, contextual telemetry, and adaptive enforcement, according to Cyberhaven. The real shift is governance: security programs now have to prove trust continuously rather than rely on checkpoint-style assurance.
At a glance
What this is: Cyberhaven frames AI-era defense as a move from episodic security to continuous assurance, with validation embedded across build, deploy, and operate stages.
Why it matters: IAM, NHI, and security teams should treat trust as a continuously verified condition, because static checkpoints cannot keep up with machine-speed change and AI-assisted attack paths.
Context
Continuous assurance is the idea that security validation happens all the time, not only at audit points or scheduled reviews. In this article, Cyberhaven argues that AI-assisted attack methods and faster software delivery have made episodic security too slow for modern operating conditions, especially where access, code, and data move continuously across systems.
The governance gap is not just technical. It affects identity and access programmes because trust decisions increasingly need to be validated at issuance, at use, and during runtime rather than assumed after a periodic review. That makes continuous telemetry, behavioural context, and adaptive policy relevant to human users, service accounts, and automated systems alike.
Key questions
Q: How should security teams replace episodic checks with continuous assurance?
A: Start by identifying the controls that still depend on scheduled review, then move high-risk validation to the point of use. Continuous assurance works when identity, data sensitivity, and behaviour are evaluated together during access, build, and runtime events, rather than only after the fact.
Q: Why do AI-assisted attacks expose gaps in periodic security reviews?
A: Because the attack and the environment can change faster than the review cycle. If a control only proves trust at a checkpoint, an attacker can exploit the gap between checkpoints, especially in software delivery, automated workflows, and sensitive data movement.
Q: What breaks when access governance still relies on standing entitlements in a zero trust model?
A: Standing entitlements break the logic of zero trust because they assume access can remain valid across changing risk conditions. In a mature model, identity, workload, and data access should be re-evaluated as context changes. If access is never forced back through a policy decision point, the programme can look compliant while still leaving broad, persistent reach in place.
Q: When should organisations treat telemetry quality as a governance issue?
A: When the programme depends on proving trust continuously. If telemetry is incomplete or stale, the organisation cannot reliably distinguish expected behaviour from real risk, which means the control problem is partly one of assurance quality, not only detection.
Technical breakdown
Why episodic control fails in machine-speed environments
Episodic security assumes the environment is stable long enough for a point-in-time review to remain meaningful. That model breaks when AI-assisted attacks, rapid code delivery, and dynamic data movement change the risk surface between checkpoints. Continuous assurance replaces snapshot thinking with persistent validation, where telemetry, context, and policy enforcement operate as a loop rather than a gate. The important shift is not more alerts. It is faster confirmation that the current state still matches the intended control state.
Practical implication: move high-risk decisions from periodic review into runtime validation and exception handling.
How contextual telemetry changes access and data governance
Contextual telemetry combines behaviour, environment, access pattern, and data sensitivity so controls can respond to the situation rather than the label alone. That matters because the same action can be benign in one workflow and risky in another. In identity terms, this pushes governance beyond static entitlements toward observed use, especially for privileged users, service accounts, and automated workflows that touch sensitive data. In NHI terms, it also helps surface when machine identities behave outside their expected task scope.
Practical implication: tie sensitive access decisions to observed context, not just role membership or token possession.
Build-time validation and continuous assurance across software delivery
Cyberhaven’s model extends assurance into the software lifecycle by shifting validation earlier, from commit time onward. That reflects a broader control reality: if a problem is introduced in code, policy, or model behaviour, waiting for post-deployment review only increases exposure. Continuous assurance therefore blends static analysis, behavioural baseline modelling, and runtime monitoring into one assurance chain. The technical value is not just earlier detection. It is the ability to keep evidence current as software and AI-assisted workflows evolve.
Practical implication: instrument your delivery pipeline so security evidence is generated continuously, not only at release gates.
Threat narrative
Attacker objective: The objective is to operate faster than the organisation's assurance cycle so theft, misuse, or access abuse can occur before controls refresh.
- Entry begins when AI-assisted techniques or high-velocity software changes create a window where static controls have not yet adapted to the current state of the environment.
- Escalation occurs when attackers exploit gaps between periodic checks and real operational behaviour, using context shifts to move around controls that were calibrated for earlier conditions.
- Impact follows when sensitive data, source code, or trust decisions are evaluated against stale assurance signals, allowing misuse or exfiltration before the next checkpoint can intervene.
Breaches seen in the wild
- Slack GitHub breach 2022: Slack employee tokens stolen via a compromised vendor were used to download private GitHub repositories over the 2022 holidays.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Continuous assurance is now an identity governance problem as much as a security architecture problem. Once trust is treated as something that must be proven repeatedly, identity programmes can no longer rely on periodic certification alone. That applies to human access, service accounts, and machine-driven workflows alike. The practical conclusion is that governance has to move closer to issuance and runtime use, where actual risk appears.
Posture visibility is becoming a control, not just a measurement. The article is right to separate more findings from worse security, because better telemetry often surfaces hidden risk before it is reduced. That matters for GRC teams and IAM leads alike: the metric is no longer how few exceptions exist, but how quickly the programme can distinguish true exposure from newly visible exposure. Practitioners should treat signal quality as part of control design.
Data, code, and identity can no longer be governed as separate assurance domains. The article’s framing is strongest where it links behavioural analysis, data lineage, and adaptive policy into one operating model. That reflects a broader truth for modern enterprises: access decisions are only as defensible as the context around them. Teams that still certify identity independently of data movement will miss the combined failure mode.
Adaptive enforcement is the named concept this article points toward: controls that change with live risk rather than with calendar cycles. That concept is becoming central because AI-era environments mutate too quickly for static enforcement to remain credible. For practitioners, the implication is clear: policies, telemetry, and identity signals need to be evaluated as one continuous assurance fabric, not as separate control silos.
For NHI governance, the article reinforces that machine identities need usage-based oversight, not just inventory-based visibility. A token, workload identity, or automation account can be technically present and still operationally unsafe if its behaviour is never revalidated in context. The lesson is that NHI oversight now has to track use, drift, and policy mismatch continuously.
From our research library:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Adaptive enforcement is becoming the practical expression of continuous assurance. Security teams should expect more policy decisions to be made in response to live behaviour, especially where users, service accounts, and AI-enabled workflows touch sensitive data. The programme implication is that identity, data, and runtime telemetry now need to converge into one operational view.
Machine identities inherit the same assurance problem as human identities, but with less tolerance for delay. If a workload, token, or automation account can act, then its trust state has to be revalidated continuously as conditions change. That pushes NHI oversight toward runtime governance, not just asset inventory.
Slacker, Jira, and Confluence have become material secrets exposure channels. 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026. For practitioners, that is a reminder that continuous assurance has to include collaboration platforms, not only repositories.
For practitioners
- Implement continuous trust validation Replace point-in-time security checks for high-risk workflows with controls that validate identity, data sensitivity, and environment context during use, not just at review time.
- Instrument behavioural baselines for privileged activity Create expected patterns for users, service accounts, and automated systems so deviations can trigger adaptive policy, escalation, or containment before damage spreads.
- Shift assurance evidence into the delivery pipeline Generate security evidence at commit and deployment stages so the programme can prove control status continuously instead of relying on audit-period snapshots.
- Correlate data lineage with access decisions Tie access policy to where sensitive data came from, where it moves, and how it is transformed so the control can reflect actual exposure, not just entitlement lists.
Key takeaways
- Episodic security no longer matches the speed of AI-assisted threats and software delivery, so trust has to be verified continuously instead of at scheduled checkpoints.
- Continuous assurance changes governance by combining telemetry, context, and adaptive controls into one operating model for identity, code, and data.
- For practitioners, the priority is to move validation closer to use, so high-risk activity is evaluated in real time rather than after a review cycle closes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Continuous assurance depends on validating permissions at use, not only at review. |
| DE.CM-01 — Networks and Systems are Monitored to Detect Potential Cybersecurity Events | The article centres on persistent telemetry and real-time validation. | |
| Recommendation — Apply PR.AA-05 to revalidate entitlements continuously for high-risk access paths. Use DE.CM-01 to monitor privileged and automated activity continuously. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Continuous assurance relies on analysed telemetry rather than periodic review only. |
| Recommendation — Use AU-6 to analyse event data continuously for behavioural drift and policy exceptions. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Persistent telemetry and signal reliability are central to the operating model described. |
| Recommendation — Implement CIS-8 to keep audit logging continuous and useful for real-time assurance. | ||
| MITRE ATT&CK | TA0007;TA0010 — Discovery; Exfiltration | The article discusses modern exfiltration scenarios and detection against changing attack paths. |
| Recommendation — Map adaptive monitoring to TA0007 and TA0010 to spot discovery-driven exfiltration patterns. | ||
Key terms
- Continuous Assurance: A control model that checks identity and security conditions continuously instead of only during scheduled audits. It improves readiness in dynamic environments, but it requires clear thresholds, exception handling, and human accountability so automation does not outpace governance.
- Behavior Baseline: A record of normal activity for a non-human identity, including typical consumers, resources, and actions over time. Baselines help security teams detect when an identity is being used in an unusual way and provide the context needed to enforce least privilege safely in dynamic environments.
- Adaptive Controls: Adaptive controls are security measures that change based on user risk, attack exposure, or observed behavior. They can include step-up authentication, browser isolation, and targeted awareness actions. The goal is to apply stronger protection when a person, message, or session shows signs of elevated risk.
- Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for teams building practical control models across identity, access, and machine-driven workflows.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org