Cyera board move highlights the governance shift in AI security

At a glance

What this is: Cyera’s board appointment announcement frames AI security as a data governance problem shaped by autonomous agents, real-time access, and shifting risk boundaries.

Why it matters: For IAM, NHI, and security teams, the implication is that data access governance now has to account for machine actors and changing context, not just static entitlements.

Context

The article is about a governance shift in AI security, not a product feature update. Cyera uses the board appointment of Stripe CFO Steffan Tomlinson to argue that AI systems and autonomous agents are changing how organisations think about sensitive data, risk, and access.

The core problem is that data risk is becoming continuous. Sensitive data now moves across cloud environments, internal systems, and third parties while AI systems and autonomous agents act on it in real time, which makes static location-based controls insufficient for modern identity and data governance.

For security and identity leaders, the important question is no longer only where data resides. The harder question is who or what can use it, under what conditions, and how quickly that access boundary can change when machine actors are involved.

Key questions

Q: How do teams keep data access compliant when AI agents need fast access?

A: Teams should create explicit policy paths for AI consumers, with logging, scope limits, and approval logic that matches machine speed. The key is to avoid letting AI agents borrow human workflows by accident. If the access pattern is not designed for machine consumption, organisations will either block legitimate use or overgrant access.

Q: Why do static data location controls fall short for AI security?

A: Because data can be low risk at rest and high risk once an AI system can retrieve, combine, or move it across services. Location tells you where data sits, but not how it will be used in a live workflow. Runtime use, actor type, and access context determine the actual exposure boundary.

Q: What breaks when access review processes are used for autonomous agent governance?

A: Access review processes break when the system under review changes access and action paths within the same operating session. Human-paced recertification assumes privileges remain stable long enough to be observed and attested. For autonomous agents, the control can arrive after the risky action has already completed, which makes the review mostly historical.

Q: What is the difference between human and machine access governance?

A: Human governance relies on periodic judgment by managers and administrators. Machine governance requires telemetry, ownership mapping, and automated enforcement because access changes too fast for manual review. The key difference is that machine access must be governed continuously, not episodically.

How it works in practice

Why data location is no longer enough for AI security

Traditional data security programmes often start with discovery and classification, then add access controls around known storage locations. That model breaks down when data moves across cloud services, internal systems, and third parties while AI systems consume it dynamically. In that environment, the relevant control point is not only at rest or in transit, but in use, where access can be exercised by people, applications, and machine actors in fast-changing contexts. The article’s central shift is from static custody to live authorisation and usage governance.

Practical implication: treat data usage and authorisation context as first-class governance signals, not just storage location and classification.

How autonomous agents change access governance

Autonomous agents complicate identity governance because they can access data and act on it in real time, often without a human user sitting behind each action. That means access decisions are no longer just about user entitlements or application permissions. They also include machine actors that may retrieve, combine, and propagate sensitive data as part of their runtime behaviour. The control challenge is therefore closer to governance of non-human identity than to traditional human access management, especially when agent activity changes by session, task, or prompt context.

Practical implication: extend entitlement review and access policy design to the machine actors that can independently touch sensitive data.

What real-time risk management means for modern identity programmes

Real-time risk management in AI security means accepting that access boundaries are dynamic, not fixed. A dataset may be low risk in one workflow and highly sensitive when an AI system can infer, correlate, or redistribute it at speed. That creates an operating model problem for IAM, IGA, and data security teams because approvals, recertification, and segregation rules were built for slower decision loops. The governance layer now has to understand data sensitivity, identity type, and runtime context together rather than as separate controls.

Practical implication: align identity policy, data policy, and runtime monitoring so access decisions can adapt as risk changes.

NHI Mgmt Group analysis

AI security is moving from location control to use control. The article’s core argument is that sensitive data can no longer be governed adequately by knowing where it lives. Once AI systems and autonomous agents can reach that data across clouds, internal systems, and third parties, the decisive question becomes how it is used and by whom or what. That shifts the security centre of gravity from storage-centric controls to runtime governance, which is now a core IAM and NHI problem.

Autonomous agents turn data governance into identity governance. When a machine actor can independently access and act on data in real time, the organisation is no longer only managing human permissions or application service accounts. It is managing non-human identity behaviour that can widen or contract access boundaries during execution. That makes AI security inseparable from NHI governance, because the risk comes from runtime authority, not just from the data itself.

Constant risk makes static review models less relevant. The article describes a world where risk changes over time, not on a quarterly schedule. Access reviews and recertification still matter, but they cannot be the only control when permissions are exercised by systems that operate continuously. The practical conclusion is that identity governance has to move closer to issuance, usage, and enforcement time, especially for machine actors.

Data in use is the new governance frontier. Cyera’s framing highlights a broader market shift toward controlling not only data at rest and in motion, but data that is actively being processed or consumed by AI. That is where traditional boundary assumptions fail first, because the security question becomes behavioural, not just positional. Practitioners should expect more convergence between data security, IAM, and machine identity controls.

Runtime access boundary drift: The article describes a condition where access can expand or contract as AI systems interact with data across environments. That is a governance problem because the effective privilege set is no longer stable enough to be reasoned about only at provisioning time. The implication is that identity and data teams need shared visibility into how access changes while work is underway.

From our research library:

• Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.

What this signals

Runtime access boundary drift: AI security programmes now need to manage the fact that the effective access boundary can change while a task is in progress. That is a strong reason to align data controls, identity controls, and runtime monitoring around the same policy plane.

The Cyera framing is also a reminder that governance for autonomous systems cannot stop at entitlement assignment. If a machine actor can retrieve data, reason over it, and act on it at speed, the organisation needs control points that operate at the same cadence.

Security leaders should expect AI security to converge with NHI governance, because the core problem is no longer only the data set. It is the actor, the authority it has at runtime, and the path it can open next.

For practitioners

• Map AI data paths by runtime use Inventory where sensitive data is accessed, transformed, and redistributed by AI systems, autonomous agents, and traditional applications across cloud and third-party environments.
• Extend governance to machine actors Include non-human identities in access reviews, policy scope, and ownership assignments so agent and workload access is governed alongside human access.
• Separate data discovery from usage control Use discovery and classification for visibility, then add policy enforcement for data in use so access decisions reflect context, purpose, and actor type.
• Tighten controls around third-party data exposure Review how third-party systems and external services can reach sensitive data, then limit the privileges that let those paths persist beyond their business need.

Key takeaways

• AI security governance is shifting from data location to data use, which makes runtime authority the control variable that matters most.
• Autonomous agents turn sensitive data access into a non-human identity problem, so machine actors must sit inside governance scope.
• The practical response is to align discovery, authorisation, and runtime monitoring so access can change as risk changes.

Key terms

• Runtime Access Boundary: A runtime access boundary is the set of permissions, tools, and data paths an AI system can use while it is operating. For AI and NHI governance, it defines the difference between controlled execution and a workflow that can reach beyond its intended scope.
• Data In Use: Data in use is information being actively accessed, processed, or modified by a user, application, or workload. It is the hardest state to govern because policy must follow live identity behaviour, not just storage location or network transit.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.