Topic starter
09/07/2026 3:31 pm
TL;DR: AI-powered insider threats are expanding beyond human-only tactics as attackers use LLMs, deepfakes, shadow AI, and compromised machine identities to accelerate reconnaissance, fraud, and lateral movement, according to Gurucul. Traditional rules-based controls are no longer enough when identity abuse can be generated, impersonated, or orchestrated at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: “AI on Both Sides of the Battlefield – The New Face of Insider Threats”.
Key questions
Q: What breaks when insiders use AI to automate reconnaissance and fraud?
A: Static detections break first because AI can generate many small variations of the same malicious activity, from prompts to scripts to deepfake lures.
Q: Why do deepfakes create such a problem for video-based approval processes?
A: Because they exploit a control assumption that was never designed for synthetic media.
Q: What signs show that an AI deployment has shadow identity and access risk?
A: Look for undocumented MCP servers, untracked tools, unreviewed data paths, and agents that can reach both sensitive data and write-capable systems.
Practitioner guidance
- Map insider AI misuse to identity telemetry Correlate unusual prompt activity, login context, data access, and endpoint behaviour so AI-assisted insider activity is evaluated as one identity event chain.
- Separate executive trust from executive identity Require out-of-band confirmation for high-risk approvals, fund transfers, and access grants that arrive through voice or video channels, even when the message appears to come from a leader.
- Inventory privileged access to AI platforms Document which human and non-human identities can reach model environments, what they can query, and whether those privileges are monitored and time bound.
Bottom line: AI-assisted insider threats combine human intent with machine-scale speed, which makes identity behaviour harder to distinguish from normal work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:52 pm
AI-powered insider threat is now an identity governance problem, not just a detection problem: The article shows that insiders can use generative AI to compress reconnaissance, content generation, and malware development into workflows that look ordinary until harm is already underway. The governance challenge is that the abuse still travels through legitimate identities, approved tooling, and trusted channels. Practitioners should read this as a sign that identity telemetry must be analysed as behaviour, not just access status.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should security teams prioritise behavioural analytics or autonomous response for insider threats?
A: Behavioural analytics should come first because it establishes what normal identity and entity activity looks like before response automation acts on it. Autonomous response is useful only when it is constrained by reliable context and clear guardrails. Without that sequence, automation can amplify false positives or create unnecessary access disruption.
👉 Read our full editorial: AI-powered insider threats are reshaping identity and SIEM governance