Topic starter
08/02/2026 10:25 pm
TL;DR: AI is making social engineering more personalized, while shadow AI and overreliance on machine output increase data leakage and insider-risk exposure, according to CyberArk. The security issue is not AI itself but the weakening of human verification and identity discipline around it.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “Are we trusting AI too much?”.
Key questions
Q: How should security teams reduce phishing risk when AI makes scam messages more convincing?
A: Teams should stop relying on obvious spelling mistakes and train people to verify the sender, destination, and request through a separate channel.
Q: Why do shadow AI tools create identity governance risk?
A: Shadow AI is risky because users often reach those tools through identities, browser sessions, or tokens that were never assessed for data handling or access scope.
Q: What breaks when AI-generated findings are trusted without validation?
A: Teams can accept false positives, miss exploit conditions, or overlook hidden dependencies that only appear under real-world use.
Practitioner guidance
- Tighten verification for high-risk requests Require out-of-band confirmation for credential resets, wire transfers, privilege changes, and unusual data requests that arrive through email, chat, or AI-generated channels.
- Publish an approved AI use policy Specify which AI tools are approved, what data types are prohibited, and where human review is mandatory before prompts or outputs are used in business processes.
- Remove standing privileges from sensitive workflows Use just-in-time access for admin tasks, production systems, and other critical environments so a manipulated identity has less time to abuse access.
Bottom line: AI is amplifying social engineering by making deceptive messages more personalised and believable, which weakens the human verification step many identity controls depend on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:41 pm
AI is now an identity problem before it is a model problem. The article shows that attackers are exploiting human trust in AI output and in AI-shaped communication, which means the first failure is often verification discipline rather than technical compromise. Security teams should treat AI-mediated persuasion as a control boundary issue, not a content-quality issue.
A question worth separating out:
Q: Why do stale identities weaken least privilege and just-in-time access?
A: Least privilege and just-in-time access depend on current identity state, current ownership, and accurate privilege scope. When stale identities remain active, the control can still operate but it no longer reflects the real access landscape. That creates hidden standing privilege and undermines the assurance the programme is supposed to provide.
👉 Read our full editorial: AI trust is weakening identity controls and social engineering