Notifications
Clear all
Topic starter
20/08/2026 5:45 pm
TL;DR: Employees using generative AI are creating an often invisible attack surface, and Living Security Human Risk Management Platform argues that securing AI requires correlating human behaviour, identity and access signals, and threat intelligence to reduce prompt injection, data leakage, and model abuse. The practical shift is from reactive detection to governed prevention across the AI lifecycle, with human-led automation and least-privilege controls doing the heavy lifting.
NHIMG editorial — based on content published by Living Security Human Risk Management Platform: 9 AI Cybersecurity Best Practices for Your Enterprise
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: How should security teams govern generative AI tools that connect to core systems?
A: Treat them as non-human identities with lifecycle, access, and telemetry requirements.
Q: Why do AI systems create identity and access risk beyond traditional AppSec?
A: Because AI systems often act through delegated access.
Q: Why are AI gateways not enough to stop prompt injection and data leakage?
A: AI gateways control where traffic goes, but they do not understand what the traffic means.
Practitioner guidance
- Map AI usage to identity and access paths Inventory who can reach each AI tool, model endpoint, training dataset, and connected system, then align that access to least privilege and approval boundaries.
- Classify prompts and generated outputs as governed data Define which prompt content is prohibited, which outputs require review, and where sensitive data must be blocked, redacted, or retained for audit.
- Track AI credentials and API tokens as security assets Include model keys, service tokens, and automation credentials in the same rotation, revocation, and monitoring processes used for other secrets.
What's in the full article
Living Security Human Risk Management Platform's full blog post covers the operational detail this post intentionally leaves for the source:
- Specific examples of how employee actions create AI risk across prompts, code, and connected tools
- Stepwise AI security best practices for data access, model hardening, and runtime monitoring
- Human Risk Management workflow detail for correlating behaviour, identity, and threat intelligence
- Practical guidance on turning AI usage into audit-ready security evidence
AI attack surfaces and human risk governance , what teams need now?
Explore further
20/08/2026 6:27 pm
Human behaviour is now part of the AI attack surface. The strongest lesson in this article is that employees are already shaping AI risk every time they paste prompts, accept generated code, or connect tools to sensitive systems. That makes AI security inseparable from identity governance, because the path to compromise often runs through legitimate access rather than exotic exploits. Practitioners should stop treating AI use as a side channel and start treating it as governed enterprise activity.
A question worth separating out:
Q: How can security teams tell whether AI lifecycle controls are working?
A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current. If those signals are fragmented across platforms, the programme may be documenting governance rather than enforcing it. Continuous traceability is the practical test.
👉 Read our full editorial: AI cybersecurity best practices need human risk governance
