Topic starter
10/06/2026 11:45 pm
TL;DR: IBM’s Cost of a Data Breach Report 2025 says the global average breach cost fell to $4.44M, but 97% of organisations with AI-related breaches lacked proper AI access controls and shadow AI added $670K per incident, according to Pomerium. The issue is not AI adoption itself but the failure to govern AI agents and other NHIs with continuous authorisation and least privilege.
Editorial analysis by NHI Mgmt Group, based on content published by Pomerium: “AI Is Your Biggest Security Risk”.
By the numbers:
- The global average cost of a data breach fell to $4.44M in IBM’s 2025 report.
- 97% of organisations that experienced an AI-related breach lacked proper AI access controls.
- Shadow AI added an additional $670K per breach.
Key questions
Q: What breaks when AI agents keep standing credentials?
A: The access model breaks because the agent can continue acting after the human has moved on, the workflow has shifted, or the original approval is no longer relevant.
Q: Why do AI-related breaches look more like identity failures than model failures?
A: Because the common pattern is misuse of existing access, not exploitation of the model’s reasoning.
Q: How do you know if AI access controls are actually working?
A: They are working only if you can answer three questions consistently: which identity accessed the system, which data it touched, and whether that access matched the intended business use.
Practitioner guidance
- Define AI access as a governed identity class Inventory LLMs, copilots, plugins, service accounts, and autonomous agents as separate identity subjects with explicit owners, scopes, and review cadences.
- Replace durable credentials with short-lived access Eliminate embedded secrets from AI workflows where possible and issue narrowly scoped, time-bounded credentials that can be revoked without breaking unrelated services.
- Enforce per-request authorisation for internal resources Apply policy checks at every access attempt to APIs, admin surfaces, and model endpoints so an approved session does not become open-ended trust.
Bottom line: AI-related breach risk is increasingly an access-control problem, with identity governance lagging behind deployment of LLMs, copilots, plugins, and autonomous agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 6:06 am
AI breach exposure is becoming an identity governance problem, not an AI novelty problem. The article’s central point is that AI-related incidents expose weaknesses in access control, authorisation, and lifecycle governance, not just model security. When AI systems authenticate to internal services, the relevant question becomes whether the identity layer can distinguish legitimate use from overbroad, unattended, or shadow access. Practitioners should treat AI security as an IAM and NHI governance discipline first.
A question worth separating out:
Q: How should teams govern AI assistants, workflows, and autonomous agents differently?
A: Teams should govern them by runtime behaviour, not by model family. Assistants need strong prompt and response controls, triggered workflows need untrusted-input screening and narrow tool scope, and autonomous agents need separate identities, scoped delegation, and traceability across each decision. A single AI policy rarely fits all three.
👉 Read our full editorial: AI access controls lag as breach costs fall in IBM data
This post was modified 1 day ago by NHI Mgmt Group