Notifications
Clear all
Topic starter
04/09/2026 4:34 pm
TL;DR: AI agents now fit the insider threat definition because they hold standing access, act at machine scale, and were never onboarded or assigned a manager, according to Above. The analytical shift is that insider risk, access governance, and investigation models must now account for non-human actors whose behaviour breaks human-paced assumptions.
NHIMG editorial — based on content published by Above: Above Theory and Forscie unveil the Synthetic Insider Threat Matrix™
By the numbers:
- That number is projected to cross 2.2 billion by 2030.
Questions worth separating out
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI coding agents increase insider risk so quickly?
A: AI coding agents increase insider risk because they amplify a user’s speed, persistence, and reach without requiring the same level of expertise.
Q: What are the signs that synthetic insider risk is not being governed well?
A: The clearest signs are agents with no named owner, standing access that is never recertified, repeated action bursts that exceed human work patterns, and investigation teams that cannot classify what the agent did.
Practitioner guidance
- Create an inventory of synthetic insiders List every AI agent with standing access, the systems it can reach, the human owner, and the business purpose for that access.
- Map agent behaviour to investigation categories Define a shared taxonomy for agent actions so SOC, IAM, and risk teams classify the same event the same way during triage.
- Rework access reviews around machine cadence Replace human-only recertification assumptions with review criteria that account for high-frequency agent activity, runtime scope changes, and delegated tool use.
What's in the full article
Above’s full blog post covers the operational detail this analysis intentionally leaves for the source:
- The article’s own framing for why the Synthetic Insider Threat Matrix was created and how Above and Forscie position it.
- The practical explanation of how the matrix is intended to give teams a shared vocabulary for AI agent insider behaviour.
- The author’s description of how the taxonomy can be used in investigative workflows and production mapping.
- The broader product and partnership context behind the matrix without the editorial interpretation used here.
👉 Read Above’s blog post on the Synthetic Insider Threat Matrix and AI agent insiders →
AI agents as insiders: what changes for identity and risk teams?
Explore further
04/09/2026 4:34 pm
The insider threat model now has an actor-type problem, not just a behaviour problem. For twenty years, insider programs assumed a human end user with a lifecycle, a manager, and a reviewable employment relationship. That assumption no longer holds when the actor is an AI agent with legitimate credentials and no human operating cadence. The implication is that insider governance must be recast around actor type, not just suspicious behaviour.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: How should teams manage insider risk when AI agents have legitimate access to sensitive data?
A: Treat AI agents as governed non-human identities, not as ordinary tools. Define what they can access, monitor the actions they can take, and revoke access when the workflow no longer needs it. Pair behavioural monitoring with IAM, PAM, and NHI controls so machine-scale access is visible, bounded, and auditable.
👉 Read our full editorial: Synthetic insider threats expose a broken human-only insider model
