Notifications
Clear all
Topic starter
21/08/2026 4:58 pm
TL;DR: As organizations adopt LLMs, Living Security Human Risk Management Platform argues that the real security issue is not just model abuse but the expansion of the attack surface through AI agents, which behave like non-human actors and require identity-aware governance. The implication is that security teams must treat AI access, prompt handling, and human-machine interaction as one control problem, not separate domains.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: AI Cybersecurity for Large Language Models: Risks & Defense
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
Questions worth separating out
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Q: Why do LLMs complicate IAM and PAM programmes?
A: Because they blur the line between a user, an application, and an acting system.
Q: What do security teams get wrong about prompt injection defence?
A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload.
Practitioner guidance
- Define machine identities for every LLM integration Assign each model-connected workflow a named owner, explicit permissions, and a documented revocation process.
- Restrict tool use to task-scoped permissions Limit each AI agent to the smallest tool set and data path needed for the approved workflow.
- Validate all prompts, retrieved context, and training inputs Sanitise untrusted text before it reaches a model, and isolate external content from privileged system instructions.
What's in the full article
Living Security Human Risk Management Platform's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how the platform correlates employee behavior, identity signals, and AI activity across a single risk view
- Specific examples of automated remediation such as micro-training, quarantine actions, and alert triage workflows
- Discussion of how the Human Risk Management model is applied to both human and non-human actors in practice
- Practitioner-facing guidance on how to start building AI-native risk controls into an existing security programme
AI agents as identities: what LLM security teams need to change?
Explore further
21/08/2026 5:14 pm
AI agents are now an identity governance problem, not just an AI security problem. Once an LLM can access systems, call tools, or act on behalf of a user, it becomes a non-human identity that must be governed like any other privileged actor. That means ownership, scope, and revocation matter as much as prompt safety. Teams that keep these concerns separate will miss how quickly model access becomes operational access.
A question worth separating out:
Q: How should organizations approach the governance of AI agents?
A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls. This ensures that all agent actions are tracked, authorized appropriately, and assessed for compliance.
👉 Read our full editorial: LLM cybersecurity now depends on governing AI agents as identities
