Topic starter
11/11/2026 5:56 pm
TL;DR: 70% of organisations give AI systems more access than they would give a human employee, according to WithSecure's survey and research evidence. AI security now depends on discovering every tool and agent before policy, because ungoverned access widens the attack surface faster than manual review can close it.
Editorial analysis by NHI Mgmt Group, based on content published by WithSecure: “AI Security: Why It’s Now a Board-Level Priority (And What To Do About It)”.
By the numbers:
- Gartner expects generative AI to be a factor in 22% of all cyberattacks and data leaks by 2028.
Key questions
Q: Why does shadow AI create a governance gap for IAM and security teams?
A: Shadow AI creates a governance gap because organizations cannot manage systems they do not reliably see.
Q: Why do connected AI agents increase the impact of prompt injection?
A: Connected agents expand one poisoned prompt into a broader execution graph.
Q: What do teams get wrong when onboarding third parties into identity and access management programs?
A: The most common mistake is treating onboarding as a manual, one-time approval instead of a controlled lifecycle.
Practitioner guidance
- Implement continuous discovery for AI assets Map AI-integrated SaaS, browser extensions, embedded assistants, agents and their service identities before issuing policy or approvals.
- Treat every AI agent as a first-class identity Assign unique identities, least-privilege access and explicit retirement rules to agents that touch repositories, data or business workflows.
- Add security gates to AI intake Require lightweight review before new AI tools reach production, with pre-approved options for common business use cases.
Bottom line: AI security is now a governance issue because AI adoption is outpacing the organisation's ability to inventory, approve and oversee what is already running.
Glossary terms: Shadow AI, AI Agents, Non-Human Identity (NHI), Prompt Injection (Agentic)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
AI security is now a governance problem, not a tooling problem. The central failure is sequencing: organisations adopt AI first and ask security to govern it after the fact. That means the real control boundary sits at intake, approval and identity assignment, not at the point of incident response. The field should treat AI adoption like any other high-risk capability that requires ownership, review and auditability from the start.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the best way to secure AI agents that use SaaS tools?
A: Secure AI agents by giving each agent a unique identity, least-privilege tool permissions, and short-lived delegated credentials such as OIDC tokens or scoped API keys. Bind actions to a human owner, log every tool call, and revoke access when the agent’s task, model, or approval scope changes. Separate read, write, and admin functions, and require step-up approval for sensitive actions.
👉 Read our full editorial: AI agents and shadow AI are becoming a board-level security issue