Topic starter
15/08/2026 6:06 pm
TL;DR: AI security best practices now center on identity, least privilege, and runtime monitoring because AI systems create dynamic attack surfaces and a single compromised API key can expose entire training datasets, according to Obsidian Security. The core issue is that security programmes still assume stable, reviewable access while AI agents act with broad, shifting privileges across cloud and SaaS systems.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “AI Security Best Practices: Building a Foundation for Responsible Innovation”.
By the numbers:
- AI related security incidents cost enterprises an average of $4.88 million per breach, with recovery times extending 38% longer than traditional attacks.
- A 2024 OWASP study found that 67% of deployed LLM applications contained at least one exploitable prompt injection vulnerability.
Key questions
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Q: Why do agentic AI deployments increase breach risk even when the model is accurate?
A: Accuracy does not remove risk when the system can still take harmful actions.
Q: When do AI access controls fail in practice?
A: They fail when authorization happens after retrieval, when tool permissions are broad, or when response masking is treated as optional.
Practitioner guidance
- Define each AI agent as a distinct non-human identity Create separate identities for agents, service accounts, and integrations so every action is attributable and revocable.
- Replace persistent keys with short-lived credentials Issue task-scoped tokens that expire quickly and cannot be reused outside the current workflow.
- Enforce authorization at the gateway Apply policy before tool calls, data access, and model inference rather than trusting the model to self-limit.
Bottom line: AI security failures increasingly start with identity and access, not with model accuracy alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:15 pm
AI security has crossed from model protection into identity governance. The article is strongest when it treats agents, LLMs, and SaaS-connected workflows as identity-bearing systems rather than software features. That shift matters because authorization, auditability, and offboarding now determine whether AI expands the attack surface or stays within governance boundaries. Practitioners should stop asking only whether the model is safe and start asking whether the identity model is coherent.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How should enterprises govern AI agents across multiple clouds and SaaS platforms?
A: Enterprises should treat AI agents as distributed NHIs and govern them with a unified model for discovery, ownership, secrets, and policy enforcement across every runtime they touch. The hard part is not defining the control model but applying it consistently across heterogeneous environments, and the implementation patterns vary by stack. The NHI Lifecycle Management Guide covers the operational side in more detail.
👉 Read our full editorial: AI agent security best practices expose the identity gap