Notifications
Clear all
Topic starter
22/06/2026 10:18 am
TL;DR: Organisations where AI expanded access saw a 43% breach rate versus 11% where it did not, according to Netwrix’s 2026 Data and Identity Security Report, while only 11% report full AI security readiness and 76% do not fully govern or monitor non-human identities. The core issue is pace: governance still moves slower than AI-driven identity and data access changes.
NHIMG editorial — based on content published by Netwrix: Netwrix 2026 Data and Identity Security Report on AI adoption outpacing readiness
By the numbers:
- Organisations where AI expanded access saw a 43% breach rate over the past twelve months, compared with 11% where AI had not materially changed access patterns.
- Only 11% of organizations report full AI security readiness, while 17% remain entirely unprepared and 45% are still developing governance programs.
- Only 23.5% of organizations can respond at the speed attackers move.
Questions worth separating out
Q: How should security teams govern AI-driven access growth without slowing delivery?
A: Treat AI-driven access growth as an identity capacity problem.
Q: Why do AI-enabled environments increase breach risk for identity teams?
A: AI-enabled environments increase breach risk because they expand identity sprawl and reduce the time available for review.
Q: How do organisations know whether AI security governance is actually working?
A: Use operational indicators, not policy statements.
Practitioner guidance
- Inventory AI-adjacent identities and permissions Build a current list of service accounts, tokens, application permissions, and other non-human identities used by AI-enabled workflows.
- Correlate sensitive data to reachable identities Create a control map that links sensitive datasets to the identities, applications, and workloads that can access them.
- Shorten revocation and response cycles Measure how long it takes to remove standing access after a risk signal or access change.
What's in the full report
Netwrix's full report covers the operational detail this post intentionally leaves for the source:
- Breakdowns of breach rates by organisation size, industry, and region for benchmarking AI readiness
- Methodology details on the 2,317 respondents and the 1,889-organisation dataset
- The Data, Identity & AI Security Assessment that scores posture across 12 security dimensions and five maturity tiers
- Additional findings on shadow AI monitoring, standing access removal, and remediation speed
👉 Read Netwrix's 2026 Data and Identity Security Report on AI readiness and breach risk →
AI security readiness gaps are widening fast for IAM teams?
Explore further
22/06/2026 11:08 am
AI readiness is now a governance throughput problem, not a policy problem. Netwrix’s numbers show that organisations are adding access faster than they can govern it, which turns identity control into a speed mismatch. The breach gap is not explained by AI alone. It is explained by governance systems that still assume access changes slowly enough to review later. Practitioners should read this as a capacity warning for IAM, IGA, PAM, and NHI programmes.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: Who is accountable when AI-related access outpaces governance?
A: Accountability sits with the owners of identity, data, and platform controls together, because AI-related access problems cross programme boundaries. IAM, IGA, PAM, and security leadership must share responsibility for visibility, revocation, and ownership. If one team can create access but no team can remove it quickly, the control model is incomplete.
👉 Read our full editorial: AI adoption is outrunning identity security readiness in 2026
