Notifications
Clear all
Topic starter
10/06/2026 12:15 am
TL;DR: SACR’s evaluation of 15 vendors argues that 72% of organisations are already using or testing AI agents, while more than half of deployed agents lack active monitoring, making visibility and contextual risk scoring the core requirements for agentic defence, according to Orca Security. The real shift is that AI governance now depends on identity, data, and intent being analysed together, because static controls cannot keep up with autonomous behaviour.
NHIMG editorial — based on content published by Orca Security: The Convergence of AI and Data Security, an industry-wide technoscope of unified agentic defense platforms
By the numbers:
- Alert noise can be reduced by up to 90% when toxic combinations are mapped instead of showing teams isolated findings.
Questions worth separating out
Q: How should security teams govern AI agents that can reach cloud data and tools?
A: Treat AI agents like governed non-human identities with explicit ownership, bounded reach, and continuous monitoring.
Q: Why do static rules fail for AI posture management?
A: Static rules fail because AI systems change state quickly and their risk depends on context, not just configuration.
Q: How do organisations decide which AI risks to fix first?
A: Prioritise the combinations that create the largest reachable blast radius.
Practitioner guidance
- Inventory AI assets as governed identities Build a single inventory for self-hosted models, AI services, MCP servers, and agent-connected workloads, then require ownership and data reachability to be recorded with each asset.
- Score toxic combinations, not isolated findings Use contextual risk scoring that combines identity privileges, reachable data, and tool access so teams can rank the combinations that create real blast radius.
- Map runtime AI behaviour to governance boundaries Document which prompts, tools, and cloud resources an AI system can touch at runtime, then align those paths to approval and monitoring boundaries.
What's in the full report
Orca Security's full report covers the operational detail this post intentionally leaves for the source:
- How the Unified Data Model maps AI models, self-hosted AI, MCP servers, and AI services across cloud accounts
- What Orca describes as its SideScanning approach for immediate discovery of ungoverned AI estates
- The report's framing of contextual risk scoring for toxic combinations involving identity, data, and runtime exposure
- The compliance discussion covering EU AI Act, NIST AI RMF, and other AI governance obligations
👉 Read Orca Security's report on unified agentic defense platforms →
UADP, AI posture management, and what IAM teams should notice?
Explore further
11/06/2026 1:58 am
AI posture management has become an identity governance problem, not just a cloud inventory problem. The article’s core point is that enterprises cannot govern agentic systems unless they can first find them, classify them, and connect them to the data and tools they can reach. That is a direct NHI governance problem because AI systems are now identity-bearing actors inside the environment. Practitioners should treat discovery coverage as a governance control, not a dashboard metric.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: What should IAM teams change when AI is added to the environment?
A: IAM teams should expand ownership, review, and offboarding processes so they apply to AI services and supporting non-human identities, not only human users. AI introduces assets that can be provisioned quickly, used broadly, and left behind without a clear leaver event. Lifecycle governance has to follow that pattern.
👉 Read our full editorial: AI security platform convergence is reshaping agentic defense
12/06/2026 3:32 am
AI posture management has become an identity governance problem, not just a cloud inventory problem. The article’s core point is that enterprises cannot govern agentic systems unless they can first find them, classify them, and connect them to the data and tools they can reach. That is a direct NHI governance problem because AI systems are now identity-bearing actors inside the environment. Practitioners should treat discovery coverage as a governance control, not a dashboard metric.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: What should IAM teams change when AI is added to the environment?
A: IAM teams should expand ownership, review, and offboarding processes so they apply to AI services and supporting non-human identities, not only human users. AI introduces assets that can be provisioned quickly, used broadly, and left behind without a clear leaver event. Lifecycle governance has to follow that pattern.
👉 Read our full editorial: AI security platform convergence is reshaping agentic defense
