ECB action plans for AI cyber threats expose identity gaps

At a glance

What this is: The ECB is requiring significant institutions to submit action plans for AI-enabled cyber threats, and the central finding is that faster attack cycles will expose existing identity and control weaknesses.

Why it matters: For IAM, PAM, IGA, and NHI teams, this turns identity governance into a supervisory priority because least privilege, access visibility, and lifecycle control now sit inside the AI cyber resilience agenda.

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read Nexis's analysis of the ECB action plan for AI cyber threats

Context

The ECB's action plan requirement is best read as an identity and resilience problem, not just a cyber policy update. Banks are being asked to turn existing controls into concrete plans that prioritise known weaknesses, because AI compresses the time available to discover, abuse, and contain exposure. In practice, that makes identity governance, least privilege, and monitoring part of the supervisory response to AI-enabled cyber threats.

For significant institutions, the important shift is sequencing. Open findings, third-party exposure, and access weaknesses now sit ahead of abstract AI strategy language, because the ECB is pushing banks to show how they will reduce attack surface and improve control execution under faster threat conditions. That is a typical pressure point for large regulated environments, where identity sprawl and fragmented evidence often slow response.

The article frames AI as an amplifier of existing control failure, which is the right lens for IAM practitioners. If attackers can move from vulnerability discovery to exploitation in hours rather than weeks, then standing access, weak ownership, and incomplete identity visibility become harder to defend in front of supervisors and auditors alike.

Key questions

Q: How should banks prioritise identity controls in AI cyber resilience plans?

A: Start with the identities and access paths that expand blast radius fastest: privileged users, service accounts, APIs, and third-party connections. Then align those controls to the most serious open findings, because regulators care about sequencing, evidence, and whether the bank can reduce exposure before the next attack window opens.

Q: Why do AI-driven attacks force changes in identity governance?

A: AI-driven attacks compress the time available to detect misuse and reduce access. That means identity governance must support faster signals, tighter privilege scope, and automated remediation. If approval cycles are slower than attacker movement, the governance model is already behind the threat.

Q: What breaks when service accounts are not included in zero-trust verification?

A: The control only covers people while the attacker uses machine access. Service accounts, APIs, and application identities often carry the privileges that matter most during lateral movement, so excluding them leaves a blind spot in the exact place where attackers try to expand reach.

Q: Who is accountable when AI-driven cyber risk changes supervisory expectations?

A: Accountability sits with the organisation’s control owners, risk leaders, and executive sponsors, because the obligation is to demonstrate resilience, not simply state intent. Where identity exposure is part of the problem, IAM, PAM, and security operations must coordinate on the same evidence so that supervisors see one coherent risk story.

Technical breakdown

Why AI-enabled threats compress identity control windows

AI changes the economics of attack speed. Vulnerability discovery, exploitation, and follow-on abuse can now happen in hours instead of weeks, which shortens the time available for patching, entitlement review, and detection. That matters because many enterprise identity controls still assume a slower operating tempo, with human-paced review cycles and fragmented evidence across IAM, PAM, and access monitoring systems. When threat activity accelerates, control gaps that were tolerable in steady-state become material because they remain open during the entire attack window.

Practical implication: shorten review and escalation cycles for identities, entitlements, and exposed systems that sit on the attack path.

How zero trust and least privilege fit the ECB's focus areas

The ECB's focus on zero-trust verification, least privilege, and service accounts is a reminder that identity is part of the attack surface. Verification has to apply not only to users but also to applications, APIs, and machine identities, because those actors often carry the privileges that attackers want once they move beyond initial access. Least privilege only works when entitlements are current, scoped, and continuously checked against actual use, otherwise the control exists on paper but not in practice.

Practical implication: extend least-privilege and verification controls to service accounts, APIs, and non-human identities, not just employees.

Why audit-ready IAM documentation is now a control objective

The article's emphasis on DORA-ready IAM governance documentation reflects a deeper issue: evidence quality. Supervisory dialogue depends on current, traceable, and versioned proof that access concepts match actual configuration. If authorization data lives in spreadsheets, wikis, or disconnected exports, the organisation cannot prove that governance decisions still match operational reality. Drift detection turns that documentation problem into a control signal by showing where policy and system state have diverged.

Practical implication: treat access documentation as living control evidence and align it to detected drift, not annual review cycles.

Threat narrative

Attacker objective: The attacker aims to exploit speed, reach privileged access paths, and create disruption before defenders can prioritise and contain the event.

1. Entry occurs when attackers exploit exposed vulnerability windows or weak third-party and perimeter controls before banks can respond at human review speed.
2. Escalation follows through access abuse, where over-privileged users, service accounts, APIs, or orphaned entitlements widen the attacker’s reach across systems.
3. Impact lands as faster compromise, reduced detection time, and greater operational disruption because the control stack was not designed for AI-accelerated attack frequency.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI-enabled cyber defence is now an identity governance problem, not just a detection problem. The ECB's guidance treats AI as an amplifier of attack speed, which means the old separation between cyber strategy and identity governance no longer holds. Least privilege, access visibility, and entitlement ownership now sit inside the supervisory conversation because they determine how quickly a bank can shrink exposure. Banks that still treat IAM as an internal admin function will struggle to justify control maturity to regulators.

Fast-moving threats expose the difference between access policy and access reality. The article's focus on service accounts, APIs, and zero-trust verification shows that the real control gap is often not missing policy but stale entitlements and incomplete evidence. That is exactly where NHI governance, PAM discipline, and access monitoring converge. Practitioners should read the ECB position as a demand for operational proof, not policy language.

Identity visibility is becoming a resilience requirement. When the attack cycle shortens, fragmented IAM and PAM data creates a decision lag that banks cannot afford. Unified identity visibility: the ability to see users, applications, service accounts, and their effective privileges in one model becomes the difference between rapid prioritisation and supervisory drift. Practitioners should treat identity aggregation as part of resilience planning, not just reporting.

DORA is now intersecting with AI threat response through the identity layer. The ECB is not creating a separate AI regime here; it is using existing resilience expectations to force better sequencing, ownership, and evidence. That means banks should expect identity controls, third-party governance, and audit-ready documentation to be judged together. The implication is clear: identity programmes must be designed for regulatory review under compressed attack timelines.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
• For deeper governance context, see Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for how lifecycle control reduces standing exposure.

What this signals

With 72% of organisations already reporting or suspecting NHI breaches, the ECB's insistence on concrete AI cyber plans reinforces a wider reality: identity governance is now a resilience input, not a back-office control. Banks that cannot inventory and prioritise access paths will struggle to evidence control effectiveness under DORA and supervisory challenge.

Identity blast radius: the combined effect of standing privilege, weak lifecycle management, and fragmented visibility is now what banks must measure, not just access counts. That is why the control conversation is shifting toward continuous verification across users, applications, APIs, and service accounts, with the NIST Cybersecurity Framework 2.0 providing a useful structure for governance and response.

The next programme-level question is not whether AI changes the threat landscape, but whether the identity layer can still produce timely evidence when attack speed increases. Banks that modernise identity data, drift detection, and access ownership will be better positioned to turn supervisory requirements into repeatable control outcomes.

For practitioners

• Prioritise identity-relevant supervisory findings first Map open ECB, DORA, and internal audit findings to the identities, entitlements, and systems that sit closest to internet-facing exposure. Close the findings that expand attacker reach before broader transformation work.
• Extend least privilege to machine identities Review service accounts, APIs, and application identities alongside human access, with continuous verification of effective privileges and removal of unused access. This is where over-entitlement becomes an attack multiplier.
• Replace static access evidence with living configuration proof Use versioned authorization concepts and drift detection so governance documents stay aligned with actual system state. That gives auditors and supervisors evidence that access policy is still operationally real.
• Tighten detection around AI-accelerated attack windows Reassess monitoring thresholds, escalation paths, and containment playbooks for attack paths that can progress in hours rather than days. Faster telemetry review is now part of identity defence.

Key takeaways

• AI-enabled cyber threats turn identity governance into a supervisory issue because faster attacks expose stale access and weak ownership.
• The most relevant control failures are not theoretical AI risks but practical gaps in least privilege, service account visibility, and audit-ready evidence.
• Banks that align identity data, drift detection, and sequencing of open findings will be better placed to satisfy the ECB and reduce attack surface.

Key terms

• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Identity Visibility and Intelligence Platform: An Identity Visibility and Intelligence Platform is a layer that correlates identity data across multiple tools into one risk picture. It does not replace existing controls. It makes them more useful by connecting events, relationships, configuration, and posture so teams can prioritise what matters.
• Automated drift detection: Continuous monitoring that flags when permissions, integrations, or usage patterns change outside expected bounds. In AI native workflows, drift detection matters because access can expand silently between manual reviews, especially when ephemeral identities and agents are involved.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Nexis's full article covers the operational detail this post intentionally leaves for the source:

• The six ECB focus areas mapped into practical bank action-plan language for security and risk teams.
• The identity visibility and intelligence angle on least privilege, service accounts, and access evidence.
• The DORA-ready governance documentation approach, including versioned templates and drift checking.
• The source article's direct framing of how banks should sequence open supervisory findings before broader AI threat work.

👉 The full Nexis article covers the six focus areas, identity-layer implications, and DORA-ready governance documentation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.