Topic starter
10/06/2026 11:34 pm
TL;DR: Agentic AI is expanding the attack surface while reducing attacker breakout time to less than an hour, and organisations still struggle to combine near real-time visibility with practical identity governance, according to Orca Security’s webinar coverage. The key issue is no longer just runtime monitoring but whether cloud security programmes can govern non-human identities, telemetry, and response fast enough to keep pace.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “Top 5 Takeaways from the Webinar on Agentic AI and Cloud Native Protection”.
Key questions
Q: What breaks when runtime security cannot see the identity behind agentic AI activity?
A: The main failure is that telemetry can show an action without explaining who or what had authority to perform it.
A: Because agentic behaviour can compress the time between compromise, privilege use, and meaningful impact.
Q: How do security teams know whether runtime telemetry is actually useful for automated response?
A: Telemetry is useful when it gives enough context to support a safe decision, not just a noisy alert.
Practitioner guidance
- Map runtime events to identity context Join process, network, and workload telemetry to the NHI or agent identity that executed the action so response is not blind to privilege scope.
- Measure detection latency against breakout windows Test whether alerting, triage, and containment still work when attacker dwell time is compressed to under an hour.
- Prioritise high-risk workloads for sensor coverage Use lightweight sensors where you need deeper runtime detail and reserve agentless visibility for environments where installation overhead is not acceptable.
Bottom line: Agentic AI pushes runtime security toward identity-aware control because behaviour, privilege, and execution timing now overlap in ways older cloud models did not expect.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 5:48 am
Agentic AI collapses the separation between runtime monitoring and identity control. The article shows that once machine-driven behaviour moves faster than human review cycles, the control plane has to include who or what is acting, not just what is running. That shifts the identity security conversation from static entitlements to runtime authority and response timing. Practitioners should stop treating runtime telemetry and identity governance as parallel programmes.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: Should organisations combine agentless and agent-based runtime protection?
A: Yes, when different workloads create different operational constraints. Agentless methods reduce deployment friction and are useful for broad visibility, while agent-based or sensor-based methods can provide deeper runtime detail where precision matters. The right model is usually hybrid, but only if identity governance and response logic are aligned with the chosen coverage model.
👉 Read our full editorial: Runtime security for agentic AI is collapsing into identity control
This post was modified 1 day ago by NHI Mgmt Group