TL;DR: AI is widening the gap between assumed and actual control coverage, with roughly 20% of enterprise devices running degraded, non-compliant, or absent security controls, according to Absolute Security's recap of its Resilient CISO Summit at RSAC 2026. The practical shift is from preventing every failure to designing for rapid recovery, because resilience now depends on how quickly systems can self-heal and return to a trusted state.
At a glance
What this is: This recap says AI is accelerating control decay across enterprise environments, making rapid recovery a more realistic security objective than perfect prevention.
Why it matters: It matters because IAM, NHI, and security teams now have to govern trust, access, and recovery in environments where controls can fail silently and faster than humans can verify them.
By the numbers:
- roughly 20% of enterprise devices have security controls that are degraded, non-compliant, or simply not running
Context
Security teams have long measured success by how well they prevent compromise, but that model breaks down when controls themselves degrade, drift, or disappear without immediate detection. AI-driven change is increasing the pace of that drift, which means the governance problem is no longer only attack prevention but also control continuity and recovery.
The identity angle is easy to miss but important: trust frameworks depend on stable signals, yet AI agents, delegated access, and automated recovery workflows can change those signals faster than human review cycles can track. In that sense, resilience is becoming part of identity governance, not just endpoint or operations planning.
Key questions
Q: What breaks when security controls silently degrade across enterprise devices?
A: When controls degrade silently, policy and reality diverge. Security teams may believe devices remain protected while agents have stopped running, conflicted with other tooling, or fallen out of compliance. The result is delayed detection, longer exposure, and recovery that starts too late because no one trusted the underlying state until damage was visible.
Q: Why do AI-enabled environments make resilience harder to prove?
A: Because the environment is no longer defined by one workload or database. AI systems can change state across multiple services, so teams must prove that the restored state is coherent, not merely available. The proof point becomes whether the business logic, dependencies, and access paths match the intended operating model.
Q: How do security teams know if backup recovery is actually working?
A: They know by testing restorations under realistic conditions and checking whether identity services come back in the right order. A real test should prove that policies, groups, admin roles, and application links are restored cleanly, with RTO and RPO measured and evidence retained for audit and incident review.
Q: What is the difference between normal endpoint protection and resilience architecture?
A: Endpoint protection tries to stop compromise before it spreads. Resilience architecture assumes some failure will happen and focuses on restoring trusted state fast enough that the breach has limited operational value. The distinction is not philosophical. It changes where the control lives, how it is measured, and how quickly recovery must occur.
Technical breakdown
Why control degradation becomes a security problem in AI-heavy environments
Modern endpoint environments fail less like clean outages and more like partial control loss. Security agents can conflict with one another, become disrupted by software updates, or decay as new applications and automation layers are added. When that happens, the organisation still believes the control exists, but the actual enforcement layer may be absent, degraded, or inconsistent. That gap is amplified when AI accelerates software change and increases the number of managed components. The underlying issue is not just tool sprawl. It is the loss of a trustworthy enforcement state across devices, applications, and access paths. When control health cannot be verified continuously, policy becomes aspirational rather than operational. Practical implication: treat control integrity as a runtime state that must be measured, not assumed.
Practical implication: Measure and verify control health continuously instead of assuming deployed agents are still enforcing policy.
What rapid rehydration means for recovery architecture
Rapid rehydration is the ability to rebuild security controls and return devices or services to a known-good state automatically after disruption. The idea matters because recovery that depends on manual rebuilds is too slow for environments where attacks, misconfiguration, and software churn happen continuously. In the summit framing, resilience sits below the operating system, where embedded firmware or platform-level persistence can restore baseline controls even when higher-level software is compromised or unstable. That changes recovery from a clean-up exercise into an engineered capability. The architecture has to preserve trusted state, not merely detect broken state after the fact. Practical implication: design restoration paths that can re-establish trusted control without waiting on manual IT intervention.
Practical implication: Build automated restoration paths that can return endpoints and access services to trusted state without manual rebuilds.
How AI changes the trust problem for identity and access
AI creates a trust problem because the signals that once identified a human acting inside policy may now be generated, proxied, or imitated by software. As AI agents proliferate, behavioural cues, role context, and even some authentication workflows can become less reliable as proof of intent. That does not mean identity is obsolete. It means governance has to account for machine-mediated action, auditability, and recoverability when actions are taken by systems that behave like users but are not users. The challenge is especially acute where access, delegation, and recovery all intersect, because the same automation that improves response can also obscure accountability. Practical implication: extend identity governance to cover AI-mediated actions and the evidence needed to explain them later.
Practical implication: Extend identity governance to AI-mediated actions so auditability survives automation and delegated execution.
NHI Mgmt Group analysis
Control continuity is now a first-order security governance problem. The summit's central message is that prevention-only security models no longer match how modern environments fail. If endpoint controls silently degrade, then governance has to cover the operational state of those controls, not just their intended deployment. Practitioners should treat control continuity as a measurable assurance domain.
Rapid recovery is becoming the real control boundary. Once AI accelerates both attack speed and change velocity, the important question is no longer whether a control exists on paper but how quickly it can be restored after failure. That shifts resilience from a continuity concern into a core security design principle. Organisations should evaluate whether their recovery architecture can re-establish trusted state without manual dependency.
AI-native trust frameworks need auditability before autonomy. The article is right to surface the identity problem created by AI acting on behalf of humans. As delegated actions become harder to distinguish from direct human action, the governance gap is not authentication alone but evidence of who or what acted, under which authority, and whether that action can be explained after the fact. Practitioners should design for attributable AI behaviour, not just authorised AI behaviour.
Firmware-level persistence changes the resilience conversation. The most durable recovery model in the article sits below the operating system, where restoration is harder for attackers to interfere with and easier for defenders to trust. That matters because application-layer controls can be reinstalled only if the platform beneath them remains recoverable. Practitioners should assess whether their resilience model has a trusted recovery anchor beneath the OS.
Read next: Breach and Attack Simulation (BAS) Guide
What this signals
Control drift is becoming the hidden variable in security programmes. When devices, agents, and application layers change faster than governance processes can verify them, assurance becomes stale before it is useful. That makes continuous validation, not annual review cycles, the more realistic operating model for modern security teams.
Resilience now sits at the intersection of endpoint control and identity trust. The same environment that loses security tooling can also lose confidence in who or what is acting, especially when AI systems begin initiating or mediating actions. Security programmes should plan for attributable recovery, not just fast recovery.
Trust frameworks need a recovery story, not just an access story. If systems can be restored to a known-good state quickly, the organisation can preserve operational confidence even after compromise or drift. That shifts resilience from a post-incident concern into a core design requirement for AI-native operations.
For practitioners
- Audit control continuity across endpoints Track whether security controls remain active, compliant, and healthy after updates, agent collisions, and AI-related software changes. Use those findings to distinguish installed tools from enforced controls.
- Define a trusted recovery state Document the baseline state devices and services must return to after disruption, including access policy, security agents, and compliance settings. Recovery should restore a known-good state, not just reboot systems.
- Add AI-mediated action to governance reviews Require teams to record when automation, agents, or delegated workflows initiate changes on behalf of users. That gives audit and incident teams a way to trace authority after the fact.
Key takeaways
- The article argues that AI is widening the gap between intended and actual control coverage across enterprise environments.
- The underlying issue is not only attack speed but also silent degradation of security controls that organisations assume are still active.
- Practitioners should measure control continuity and recovery speed as core security outcomes, not as secondary operational metrics.
Related NHI Mgmt Group resources: Breach and Attack Simulation (BAS) Guide · CISO Guide: First 90 Days · AI Guardrails and AI Firewalls Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of Risk Management Strategy | The article is about resilience governance and verifying whether controls remain effective. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article touches identity trust and access continuity in AI-native environments. | |
| DE.CM-06 — External Service Provider Activities Monitored | The article highlights control drift and the need to know when protective services stop behaving as expected. | |
| Recommendation — Align resilience oversight to measurable control health and recovery outcomes, not just policy intent. Validate that access permissions still reflect actual system state after automation or recovery events. Monitor whether protective controls remain operational after updates, conflicts, or platform changes. | ||
| MITRE ATT&CK | TA0040 — Impact | The article is fundamentally about reducing the operational impact of compromise and disruption. |
| Recommendation — Map resilience controls to Impact and prioritise recovery measures that reduce downtime and blast radius. | ||
Key terms
- Control Continuity: Control continuity is the ability to preserve a security or governance control while the underlying tool, process, or platform changes. In practice, it means the control still works after migration, retirement, or replacement without losing visibility, traceability, or policy enforcement.
- Rapid Rehydration: Rapid rehydration is the process of automatically restoring devices, applications, and security settings to a trusted baseline after disruption. It is a resilience pattern that assumes failure will happen and focuses on returning to known-good state faster than attackers can exploit the gap.
- AI-Mediated Action: AI-mediated action is any operational change initiated, shaped, or executed by an AI system on behalf of a person or process. The governance challenge is to preserve attribution, auditability, and authority when software can act with user-like speed and reduced human visibility.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suited to practitioners who need to connect identity governance with recovery, trust, and operational resilience.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org