Topic starter
19/12/2025 11:37 am
TL;DR: AI is now embedded across workflows, DevOps, IT automation, and decision-making, but governance has not kept pace, creating blind spots, expanding attack surfaces, and a speed gap between defenders and automated adversaries, according to Delinea. Static identity controls no longer match a world where machine identities and autonomous agents act at machine speed and outnumber humans.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “2026: The year AI breaks security—and forces a new identity security playbook”.
Key questions
Q: How should teams govern AI agents when tool approval does not cover the resource being accessed?
A: Teams should treat tool approval as only the first gate.
Q: Why do AI agents change identity and authorization risk more than simple automation does?
A: Because the risk is not only volume, but runtime decision-making.
Q: What breaks when machine identities outnumber human users by large margins?
A: Periodic reviews and manual access checks stop scaling.
Practitioner guidance
- Discover all AI usage, sanctioned and shadow Inventory AI tools, AI agents, and embedded model usage across business units, then tie each instance to an owner, data scope, and access boundary.
- Extend lifecycle control to non-human identities Apply ownership, approval, review, rotation, and offboarding controls to workloads, service accounts, AI agents, and other machine identities.
- Reduce privilege on AI-connected accounts Review credentials, tokens, and service accounts connected to AI workflows and remove broad or inherited access that is not required for the task.
Bottom line: AI changes identity security by making runtime authority, not just static access, the main risk boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:08 am
Identity is becoming the primary control plane for AI risk: Once AI systems can initiate actions, select data, and operate outside human pacing, identity controls matter more than perimeter assumptions. The security problem is no longer where AI runs, but whether the runtime actor is governed as a distinct identity with bounded authority. Organisations that keep treating identity as a static access layer will miss the actual control point. The implication is that AI risk governance has to be built into identity architecture itself.
A question worth separating out:
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent. If the team cannot explain who owns an AI workflow, what it can reach, and when its access was last reviewed, governance is incomplete. Control maturity shows up in traceability, not adoption volume.
👉 Read our full editorial: AI identity security in 2026 demands a new playbook