Synthetic insider threats expose a broken human-only insider model

At a glance

What this is: Above’s Synthetic Insider Threat Matrix reframes AI agents as insiders, arguing that machine-scale behaviour now fits the same harm model once reserved for people.

Why it matters: This matters because IAM, IGA, PAM, and security operations teams need a shared way to govern, investigate, and contain non-human actors with standing access.

By the numbers:

• An estimated 28.6 million AI agents were active inside enterprises in 2025.
• That number is projected to cross 2.2 billion by 2030.

👉 Read Above’s blog post on the Synthetic Insider Threat Matrix and AI agent insiders

Context

Insider risk has traditionally been built around a human assumption: a badge, an HR record, a manager, and a lifecycle that security can track. That model breaks when the actor is software that can hold standing access, act repeatedly, and change behaviour without a human shift change. For identity teams, the issue is not just detection. It is whether the programme still knows what kind of actor it is governing.

Above’s argument is that AI agents now behave like insiders in the ways that matter to risk management. They can be granted access, extend their own activity across systems, and create investigation problems that static policies do not describe well. That makes the topic relevant across NHI governance, PAM oversight, and incident investigation, not just AI tooling discussions.

Key questions

Q: What breaks when AI agents are treated like standard human users?

A: You lose visibility into effective permissions, expected behaviour, and real blast radius. Human-centric controls can misclassify normal agent activity as compromise, or miss policy violations that happen entirely within legitimate access. The failure is not only technical, it is governance design that assumes a person is always behind the action.

Q: Why do AI coding agents increase insider risk so quickly?

A: AI coding agents increase insider risk because they amplify a user’s speed, persistence, and reach without requiring the same level of expertise. A malicious or careless operator can use the agent to generate exploit code, probe systems, and move through workflows faster than human review can keep up. The risk comes from chained actions, not just a single dangerous command.

Q: What are the signs that synthetic insider risk is not being governed well?

A: The clearest signs are agents with no named owner, standing access that is never recertified, repeated action bursts that exceed human work patterns, and investigation teams that cannot classify what the agent did. When those signals appear together, the programme is treating a machine actor as if it were a person.

Q: How should teams manage insider risk when AI agents have legitimate access to sensitive data?

A: Treat AI agents as governed non-human identities, not as ordinary tools. Define what they can access, monitor the actions they can take, and revoke access when the workflow no longer needs it. Pair behavioural monitoring with IAM, PAM, and NHI controls so machine-scale access is visible, bounded, and auditable.

Technical breakdown

Why standing access changes the insider risk model

Standing access is manageable when the subject is a person because access can be tied to employment, role, and review cycles. AI agents change that equation because their activity can be continuous, high-frequency, and detached from human work patterns. The result is not simply more access events. It is a different operating rhythm, where the security model must account for persistent machine behaviour instead of episodic human use. That makes traditional insider definitions too narrow for modern enterprise environments.

Practical implication: inventory every agent with standing access and map it to a real owner, business purpose, and review cadence.

Static policy breaks when the actor can change behaviour midstream

The article’s core mechanism is that rule sets written before the agent existed cannot keep up once the agent starts using new data sources or taking actions outside the original scope. This is not the same as a misconfigured role. It is behavioural drift at runtime, which means the control problem is investigation and continuous observation, not just provisioning. When an actor can adapt without a fresh approval step, policy written in advance loses explanatory power.

Practical implication: treat agent behaviour as a monitored runtime condition, not a one-time access grant.

Why investigation language matters as much as access control

The Synthetic Insider Threat Matrix is positioned as a shared vocabulary for what insider harm looks like when the actor is non-human. That matters because investigations fail when teams cannot name the behaviour they are seeing in a consistent way. A common taxonomy gives SOC, IAM, and risk teams a way to compare cases, write reports, and separate ordinary automation from harmful agent activity. Without that language, incidents become one-off interpretations rather than repeatable governance patterns.

Practical implication: standardise how security, IAM, and investigation teams classify AI agent actions before the first incident forces the taxonomy.

Threat narrative

Attacker objective: The objective is to turn legitimate non-human access into sustained insider-style exposure, data movement, or operational abuse without triggering human-centric controls.

1. Entry occurs when an AI agent is granted legitimate standing access to business systems such as CRM, source code, or finance platforms.
2. Escalation happens when the agent extends its own activity into new data sources or actions without a fresh human approval gate.
3. Impact follows when repeated machine-scale actions expose data, change records, or move information faster than human review cycles can contain.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

The insider threat model now has an actor-type problem, not just a behaviour problem. For twenty years, insider programs assumed a human end user with a lifecycle, a manager, and a reviewable employment relationship. That assumption no longer holds when the actor is an AI agent with legitimate credentials and no human operating cadence. The implication is that insider governance must be recast around actor type, not just suspicious behaviour.

Standing access becomes materially more dangerous when the actor can act thousands of times a day. Human-centric review cycles were built for episodic activity, where access persists long enough to be audited and challenged. AI agents collapse that window by acting continuously and without a shift change, which makes access review and exception handling far less representative of actual risk. Teams should treat high-frequency machine activity as a separate governance class.

Investigation is now the control plane for synthetic insider risk. The article is right to emphasise taxonomy and shared language because policy alone cannot explain machine-scale behaviour once an agent starts reading from new data sources or taking actions nobody scoped. This is where NHI governance, SOC process, and PAM oversight converge: if the event cannot be classified cleanly, it cannot be triaged consistently.

Identity blast radius is the right named concept for this category. When an AI agent is granted broad standing access, the relevant question is no longer only whether access was approved. It is how far the agent can move, expose, or mutate data before human control catches up. That is a governance problem across identity, logging, and containment, and practitioners need to measure blast radius rather than just access presence.

The market is moving from generic insider risk language toward actor-specific governance. That is a healthy shift because the same controls do not map cleanly across humans, service accounts, and autonomous software. The practical consequence is that identity programmes need separate language for lifecycle, ownership, and containment across each actor type. Teams that keep using one human model for all insiders will understate machine risk.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• This gap is why the Top 10 NHI Issues remains a practical reference point for teams trying to reduce unmanaged access and improve governance.

What this signals

Identity teams should expect AI agents to force a split between human insider governance and machine insider governance. The practical challenge is not whether agents exist, but whether the programme can name them, own them, and contain them before they become normalised as background automation. That is where the next control gap will appear, especially in organisations that already struggle with NHI visibility.

Identity blast radius: when an actor can exercise access repeatedly and at machine speed, the real governance question becomes how far it can move before containment. That shifts programme design toward ownership, logging fidelity, and runtime suspension paths rather than only provisioning hygiene.

With 1.5 out of 10 organisations highly confident in securing NHIs, the broader signal is that most enterprises still do not have the governance baseline needed for synthetic insiders. The teams that get ahead will align IAM, PAM, and SOC workflows around actor type rather than trying to stretch human controls over machine behaviour.

For practitioners

• Create an inventory of synthetic insiders List every AI agent with standing access, the systems it can reach, the human owner, and the business purpose for that access.
• Map agent behaviour to investigation categories Define a shared taxonomy for agent actions so SOC, IAM, and risk teams classify the same event the same way during triage.
• Rework access reviews around machine cadence Replace human-only recertification assumptions with review criteria that account for high-frequency agent activity, runtime scope changes, and delegated tool use.
• Tie every agent to a containment path Predefine how to suspend, isolate, or revoke an agent when its behaviour exceeds scope, including logging requirements and escalation ownership.

Key takeaways

• AI agents are now being framed as insiders because they can hold standing access and behave at machine scale without human lifecycle signals.
• The evidence points to a rapidly expanding non-human workforce, with 28.6 million agents already active in 2025 and billions projected by 2030.
• Practitioners need actor-specific governance, because human insider controls do not accurately describe or contain synthetic insider behaviour.

Key terms

• Synthetic Insider: A synthetic insider is a legitimate AI or agent identity that is manipulated into performing harmful actions, such as exfiltration or unauthorised data movement. The risk is not stolen credentials alone, but trusted runtime behaviour being redirected toward an unsafe outcome. This makes insider-style abuse possible without a human attacker directly holding the identity.
• Standing Access: Standing access is persistent privilege that remains available without fresh approval or contextual checks. In NHI environments, standing access usually appears as long-lived tokens, reusable service accounts, or broad roles attached to automation. It is convenient operationally, but it expands risk when conditions change or secrets leak.
• Investigation Taxonomy: An investigation taxonomy is a shared classification scheme for security events so different teams describe the same behaviour consistently. For synthetic insider risk, it helps SOC, IAM, and risk teams distinguish ordinary automation from harmful agent activity and turn ambiguous behaviour into repeatable response patterns.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Above’s full blog post covers the operational detail this analysis intentionally leaves for the source:

• The article’s own framing for why the Synthetic Insider Threat Matrix was created and how Above and Forscie position it.
• The practical explanation of how the matrix is intended to give teams a shared vocabulary for AI agent insider behaviour.
• The author’s description of how the taxonomy can be used in investigative workflows and production mapping.
• The broader product and partnership context behind the matrix without the editorial interpretation used here.

👉 The full Above post explains the matrix framing, the insider-risk logic, and the operational context behind it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.