Cybersecurity predictions for 2026 point to identity drift as the risk

At a glance

What this is: OFFENSAI predicts that 2026 attack paths will be shaped by cloud identity drift, CI/CD exposure and AI-enabled automation moving faster than manual review cycles.

Why it matters: This matters because identity, permissions and workflow trust are becoming the practical control plane for cloud and NHI governance, so periodic reviews will miss the speed at which attackers exploit drift.

By the numbers:

• 80% of organizations will face cloud breaches due to identity drift.

Context

Identity drift is the gap between how access is designed on paper and how it behaves in live cloud, SaaS and CI/CD environments. As environments change faster than review cycles, permissions, trust links and service relationships accumulate exceptions that attackers can exploit before teams notice.

The article's core governance problem is not a single failed control but the speed mismatch between automated attackers and periodic assurance. That has direct relevance for IAM, PAM and NHI programmes, because service accounts, tokens and delegated workflows now sit inside the same attack surface as human users.

Key questions

Q: What do security teams get wrong about workload identity in cloud and CI/CD environments?

A: They often assume short-lived credentials automatically create good governance. In practice, the registration process, delegation semantics, and audit trail matter just as much as token lifespan. Without those layers, a workload can remain identifiable while still being difficult to control or investigate.

Q: Why do service accounts and automation tokens increase breach impact when they are over-privileged?

A: Because they can move data and trigger actions at machine speed without the friction that often limits human accounts. If those identities have broad scopes or standing credentials, attackers can use them to scale theft or disruption quickly. Least privilege and short-lived access reduce the blast radius when compromise occurs.

Q: How do you know if continuous security validation is actually working?

A: You know it is working when findings are being generated, validated, and retested close to the time changes occur, not months later. Useful signals include shorter remediation cycles, fewer unverified exposures, and evidence that new assets and access paths are being covered as they appear. Freshness is the key measurement, not the existence of a finished report.

Q: Should organisations prioritise cloud identity governance or CI/CD hardening first?

A: They should do both, but start with the paths that can reach production fastest. If CI/CD workflows already hold deployment authority or cloud identities already have broad cross-service reach, those paths deserve first attention because they combine access, speed and blast radius in one place.

Technical breakdown

How identity drift turns cloud change into exposure

Identity drift appears when cloud permissions, trust relationships and service-to-service paths diverge from the intended control model after release. In practice, new features, temporary exceptions and inherited roles create access paths that survive far longer than the team that approved them expected. Attackers do not need a novel exploit if they can simply find a newly introduced trust path that was never revalidated. The article's point is that the control failure is temporal: the environment changes faster than the assurance process can confirm who can reach what.

Practical implication: treat every new cloud service, policy change and exception as an access review trigger, not a post-deployment housekeeping task.

Why CI/CD pipelines are now identity systems

CI/CD pipelines are no longer just build infrastructure. They are identity-bearing systems that hold tokens, workflow permissions, repository trust and deployment authority, which means compromise of the pipeline can become direct production access. When a runner, workflow or artifact path is over-permissioned, an attacker can move from code execution to secret use to deployment activity without crossing a separate security boundary. That is why build systems now sit in the same governance conversation as NHI and privileged access, especially when automation identities outlive the job they were created for.

Practical implication: govern build and release automation as privileged identity infrastructure with scoped tokens, monitored workflows and strict entitlement review.

How agentic AI accelerates reconnaissance and misuse

Agentic AI changes the pace of both offense and defense because it can chain reconnaissance, decision-making and action without waiting for a human operator between steps. The article describes a future in which defenders use AI for continuous validation while attackers use AI to find misconfigurations, privilege paths and weak trust relationships faster. That matters because AI agents themselves can become over-permissioned actors, especially when organisations let them inherit broad access so they 'just work.' The security problem is not simply model output quality. It is delegated action at machine speed.

Practical implication: instrument AI systems with explicit permissions, action logging and scope limits before allowing them to touch sensitive environments.

Threat narrative

Attacker objective: The attacker wants to convert fast-moving cloud and pipeline change into durable access to production systems, data and deployment paths.

1. Entry begins with rapid probing of newly released cloud services, CI/CD workflows and identity surfaces as soon as they become available.
2. Credential and privilege abuse follows when exposed tokens, service accounts or delegated automation identities provide access into build or cloud control planes.
3. Escalation occurs through misconfigured trust relationships, eventual consistency gaps and over-permissioned workflows that expand the attacker’s reach.
4. Impact is production access, data exposure or persistent control of cloud and software delivery paths without needing a traditional perimeter breach.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• ArtiPACKED 2024: Unit 42 found public GitHub Actions artifacts in major open source projects leaking live GITHUB_TOKENs, runtime tokens and cloud tokens.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity drift is the new control failure mode: the issue is no longer whether an organisation has IAM policies, but whether those policies still match live cloud and SaaS behaviour after continuous change. Temporary exceptions, inherited roles and new services create shadow access paths that manual review cannot keep up with. Practitioners should treat drift as an operating condition, not an exception.

CI/CD is now part of the identity perimeter: build systems hold the same kind of privileged trust that used to sit only in admin consoles and bastion paths. Once workflows can write to production, a single stolen token or poisoned runner becomes an identity governance failure, not just a DevOps incident. Teams should govern pipeline identities with the same scrutiny they apply to privileged human accounts.

Continuous validation fatigue: periodic review processes are being outpaced by the rate of cloud release and attacker automation. This is especially visible where human access reviews assume a stable entitlement set, yet service accounts, OAuth grants and workflow permissions change continuously. The practitioner conclusion is that validation has to move to issuance, deployment and runtime monitoring.

NHI sprawl and agentic automation are converging: service accounts, bots and AI agents are increasingly operating as a shared machine-identity layer with overlapping privilege. That makes ownership, scope and revocation harder to reason about, particularly when an agent or workflow can create new access paths on demand. Security teams should manage these actors as governed identities, not as feature-specific integrations.

The market signal is architectural, not cosmetic: the article points toward security programmes that unify cloud posture, IAM, PAM, NHI and CI/CD governance because separate reviews cannot address the same drift problem twice. For practitioners, the lesson is to measure whether identity controls can see and validate runtime trust, not just approved design states.

From our research library:

• 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
• Read next: Ultimate Guide to NHIs

What this signals

Identity drift will become an operational measure of control failure: teams will need to track whether cloud and SaaS permissions still match intended state after each change, not whether last quarter's review passed. The practical shift is from certification of access to continuous verification of live trust.

Machine identity governance is moving into the centre of cloud security: service accounts, runners and AI agents now influence whether production can be reached as much as human admins do. That is why identity governance, PAM and NHI controls have to converge around issuance, scope and revocation instead of remaining separate programmes.

Cloud and CI/CD risk is now governed by how quickly an organisation can detect and correct drift. As the article notes, 80% of organizations will face cloud breaches due to identity drift, which makes runtime validation more important than periodic review for any team protecting production paths.

For practitioners

• Build a live identity inventory across humans and machines Map users, service accounts, workload identities, OAuth grants and CI/CD automation into one current inventory so you can see which identities can reach each dataset and deployment path.
• Replace periodic review with continuous validation Re-check permissions, trust relationships and configuration drift whenever cloud services, workflows or environment roles change, because the attack window now opens within hours.
• Treat CI/CD runners as privileged assets Restrict runner permissions, isolate workflow credentials, and monitor for unexpected repository, deployment or secret-access activity from build infrastructure.
• Remove standing privilege from automation Issue short-lived scoped tokens for build and agent workflows, and revoke credentials that remain valid beyond the task or release they were created for.
• Instrument AI systems before delegation Log prompts, tool calls, decisions and permission use for any AI agent that can interact with cloud, code or security tooling, then bound its scope to the minimum required access.

Key takeaways

• Identity drift is the mechanism that lets cloud and automation trust paths outgrow the controls meant to govern them.
• OFFENSAI's 2026 outlook ties cloud breaches, CI/CD compromise and over-permissioned automation to a single speed problem between attackers and review cycles.
• The practical answer is continuous validation of cloud, NHI and pipeline identities so changes are checked at the point of issuance, not after exposure.

Key terms

• Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
• Machine Identity: The digital identity of a machine, device, or workload, such as a server, container, or VM, used to authenticate it within a network. Sometimes used interchangeably with NHI, though NHI is the broader category.
• Continuous validation: Continuous validation is the practice of re-checking user, device, or session risk after login instead of trusting access indefinitely. It recognizes that identity assurance can drift during a session, especially when endpoint state or user context changes after authentication.
• CI/CD Attack Surface: The CI/CD attack surface is the set of pipeline steps, build artifacts, credentials, dependencies, and integrations that can be abused during software delivery. It matters because build systems often have broad access to code and secrets. If controls are weak, a package, script, or job step can become a direct path to compromise.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners build the control model needed to govern drifting identities across cloud and automation.