Topic starter
15/08/2026 6:10 pm
TL;DR: AI security risk assessments have nearly doubled year over year, rising from about 37% to 64%, while 87% of organisations say AI-related vulnerabilities increased, according to AppSOC’s analysis of World Economic Forum and SC Media reporting. The real problem is that many assessments remain one-time exercises, leaving AI and agent risk to drift out of governance between reviews.
Editorial analysis by NHI Mgmt Group, based on content published by AppSOC: “AI Security Risk Assessments Are Doubling — But Risk Is Still Rising”.
By the numbers:
- 87% of organisations say AI-related vulnerabilities increased over the past year.
- AI security risk assessments have nearly doubled, rising from roughly 37% to 64% of organisations in a single year.
Key questions
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review.
Q: Why do AI agents create new privilege risk for enterprises?
A: AI agents can chain actions across tools, inherit delegated access, and execute at machine speed without a person confirming each step.
Q: What are the signs that AI security investments are not keeping pace with current threat conditions?
A: Common warning signs include heavy dependence on manual investigation, slow incident response, weak bot detection, and a security programme that cannot adapt as attack methods evolve.
Practitioner guidance
- Define AI systems as governed identities Create a classification for AI systems and agents that captures owner, purpose, data access, tool access, and approval scope.
- Move from one-time review to continuous validation Trigger reassessment when models are retrained, connectors change, prompts are updated, or new privileges are added.
- Separate task access from standing access Use least-privilege boundaries for read, write, and tool invocation so an agent cannot accumulate broad access by default.
Bottom line: AI risk is increasing because the systems themselves keep changing after approval, while many governance processes still assume a static state.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:18 pm
Static AI assessments are becoming a governance anti-pattern: a point-in-time review cannot keep pace with systems that retrain, reconfigure, and expand their integrations after approval. The article shows the market is recognising risk faster than it is operationalising control. For identity and security leaders, the lesson is to treat AI governance as a continuous state rather than a launch checklist.
A few things that frame the scale:
- Only 23% of IT leaders were very confident in their organisation's ability to manage security and governance for GenAI deployments, according to a 2025 Gartner survey of 360 IT leaders.
A question worth separating out:
Q: What is the difference between human IAM and agentic AI governance?
A: Human IAM is built around users, sessions, and relatively predictable access patterns. Agentic AI governance must also control memory, delegation, and machine-speed actions that can continue after the original request is made. That means identity policy has to follow the task lifecycle, not just the login event, and must cover both authorization and state handling.
👉 Read our full editorial: AI security risk assessments are rising, but continuous control still lags