Topic starter
26/08/2026 11:51 am
TL;DR: When AI significantly expanded the number of identities requiring access, reported breach rates reached 43% in the past year versus 11% where access patterns did not change, according to Cakewalk’s summary of Netwrix and ISACA research. The signal is not just adoption, but standing access that governance teams cannot revoke fast enough once AI systems are live.
Editorial analysis by NHI Mgmt Group, based on content published by Cakewalk: “Where AI Expands Access, Breaches Run Four Times the Rate”.
By the numbers:
- Among organizations where AI significantly expanded the number of identities requiring access, breach rates reached 43% over the past twelve months.
- Only 19% of organizations say they fully govern their non-human identities.
- 76% cannot immediately revoke standing access once it is no longer needed.
Key questions
Q: What breaks when AI access expands faster than governance can revoke it?
A: Standing access becomes persistent exposure instead of task-scoped permission.
Q: Why does broad AI access create risk for software and security teams?
A: Broad AI access increases risk because these systems can act on context, chain actions, and produce outputs that look credible even when they are wrong.
Q: How do security teams know whether NHI governance is actually working?
A: Look for lifecycle completion, not just more inventory.
Practitioner guidance
- Measure access revocation speed Test how long it takes to remove standing access from service accounts, tokens, and AI agent credentials after the entitlement is no longer needed.
- Define AI shutdown authority Document who can stop or override an AI system during an incident, and verify that the authority path works across operations and security teams.
- Scope non-human identity governance coverage Inventory which service accounts, bot accounts, and agent credentials are actually governed, then close the gap where access exists without lifecycle ownership.
Bottom line: AI access expansion is exposing a governance gap between issuance and revocation, and that gap maps directly to higher breach exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
AI access expansion has become an identity governance test, not an adoption metric. The article shows that organizations are increasing the number of identities with access before they have enough governance maturity to manage those identities. That is especially material for NHI because service accounts and agent credentials behave like production actors, not like passive records. The practitioner conclusion is that access issuance and access governance must be designed as one lifecycle, not two separate programmes.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations treat an AI system as a non-human identity?
A: Treat an AI system as an NHI when it can authenticate, request tools, or perform actions without direct human supervision. At that point it needs inventory, lifecycle, least privilege, monitoring, and revocation controls just like other machine identities.
👉 Read our full editorial: AI access is outpacing governance, and breach rates are rising