Notifications
Clear all
Topic starter
12/06/2026 9:23 pm
TL;DR: NIST IR 8596 frames AI security around inventories, accountability, permissions, and continuous risk review because AI systems now act inside business and security workflows, according to ConductorOne. The key shift is that identity governance, not just model oversight, becomes the control plane for autonomous and agentic behaviour.
NHIMG editorial — based on content published by ConductorOne: NIST’s New Cyber AI Profile Signals a Shift: AI Security Starts With Identity
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should organisations govern AI systems that can take actions, not just make recommendations?
A: Treat any AI system that can trigger tools, update records, or influence production as a governed identity.
Q: Why do AI systems create identity risk beyond traditional software?
A: AI systems can combine multiple permissions across models, APIs, service accounts, and integrations, which makes their access path harder to see and revoke.
Q: How do security teams know if AI access is properly governed?
A: Look for clear ownership, auditable action logs, least-privilege permissions, and a revocation process that works when the AI’s role changes.
Practitioner guidance
- Map AI workflows to real identities Inventory every model, agent, API, service account, and third-party integration that can initiate or influence action.
- Bound AI actions before production impact Define which AI actions require approval, which need logging, and which are prohibited entirely.
- Move from periodic review to continuous re-evaluation Treat AI permissions as dynamic entitlements that must be reassessed as models, prompts, tools, and integrations change.
What's in the full article
ConductorOne's full blog covers the operational detail this post intentionally leaves for the source:
- How the Cyber AI Profile maps to specific AI security operating models and enterprise control choices
- The article’s framing of NIST CSF 2.0 and AI RMF as the backbone for AI governance
- ConductorOne’s recommended steps for connecting AI actions to identities, permissions, and auditability
- The source post’s examples of how teams can operationalise least privilege for AI-assisted actions
👉 Read ConductorOne’s analysis of NIST’s Cyber AI Profile and AI identity governance →
NIST’s Cyber AI Profile and the identity gap in AI security?
Explore further
12/06/2026 11:25 pm
AI security is now an identity governance problem, not a model-only problem. NIST’s profile is valuable because it treats permissions, ownership, and revocation as core AI security controls. That aligns with how modern enterprises actually deploy AI, through agents, APIs, service accounts, and third-party integrations. The implication is that IAM and NHI teams are now part of AI security architecture, not downstream consumers of it.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: What frameworks should teams use to align AI security with identity controls?
A: Use NIST CSF 2.0 for governance structure, NIST IR 8596 for AI-specific cyber risk, and NIST AI RMF for broader accountability and trust considerations. If the AI system relies on service accounts or delegated credentials, add NHI controls so permissions, revocation, and monitoring stay in scope.
👉 Read our full editorial: NIST’s Cyber AI Profile puts identity at the center of AI security
