Topic starter
06/01/2026 4:36 pm
TL;DR: SaaS and AI risk converged in 2025 as third-party AI tools, OAuth integrations, and browser-based adoption expanded the attack surface, while high-impact SaaS breaches showed how trusted identities can propagate compromise across hundreds of organisations, according to Valence Security. The control gap is now about delegated access, browser context, and remediation speed, not perimeter defence.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “Why SaaS and AI Security Will Look Very Different in 2026”.
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
Key questions
Q: What breaks when SaaS access is governed only at the account level?
A: Account-level governance misses the session, grant and integration layers where SaaS access is actually exercised.
Q: When does OAuth create more risk than it reduces in SaaS environments?
A: OAuth becomes high risk when scopes are broad, tokens are long-lived, and the organization cannot see how the credential is reused across connected apps.
A: Common signals include rapid login attempts across many apps, unusual joining of communities or channels, repeated account creation, and outbound messages that closely match a target’s recent posts or interests.
Practitioner guidance
- Map browser-mediated access paths Identify where SaaS access is granted and exercised through browser sessions, OAuth grants and embedded app workflows, then classify those paths as governed identity surfaces.
- Inventory AI agents as NHIs Track agents separately from human users and traditional service accounts so that delegated permissions, runtime scope and offboarding are visible in the same control model.
- Shorten the gap between detection and revocation Build remediation workflows that can revoke risky grants, sessions and connected access quickly when a SaaS or AI workflow becomes suspicious.
Bottom line: SaaS and AI now share the same identity surface, so browser sessions, OAuth grants and embedded workflows have become the main control points.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:13 pm
Browser context has become part of identity governance: The SaaS control boundary no longer sits at the login screen. It now includes the browser session, the OAuth grant and the downstream integrations that inherit that trust. Security programmes that treat those layers as separate will miss how access is actually used, so practitioners need to govern the session as carefully as the account.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Organisations should treat SaaS agents as shared-control systems and insist on runtime policy that covers data access, tool use, downstream actions, tenant isolation, and auditability. The practical test is whether the enterprise can enforce its own rules even when the vendor owns the execution environment. If it cannot, the agent is configurable, but not truly governed.
👉 Read our full editorial: Why SaaS and AI security now hinge on identity and browser context