Topic starter
25/10/2026 11:06 am
TL;DR: More than 20% of organisations reported AI-targeted breaches, and Securiti ties that risk to surrounding system weaknesses rather than tool failures. A shared context model helps security teams see how permissions, data and AI relationships combine into one exposure path.
Editorial analysis by NHI Mgmt Group, based on content published by Securiti: “The Context Layer for Data+AI Security”.
By the numbers:
- More than 20% of organisations reported a breach targeting their AI models or applications.
Key questions
Q: Why do isolated security alerts often understate AI risk?
A: Because AI risk frequently sits in the systems around the model, not only in the model itself.
Q: What are the signs that a security programme needs toxic combination detection?
A: The clearest sign is when multiple teams report accurate findings but disagree on the severity, priority or meaning of the same environment.
A: Teams should normalise findings into a shared context model before triage.
Practitioner guidance
- Implement a shared risk graph Connect data, identity, cloud and AI findings into one model so teams can evaluate linked exposure instead of separate tickets.
- Prioritise toxic combinations over single alerts Escalate cases where overprivileged access, unclassified data and unauthorized credential sharing appear together, even if each finding is only medium severity.
- Use the context layer in breach-impact analysis Trace how an issue propagates across permissions, data and AI assets before deciding containment scope or notification impact.
Bottom line: The central issue is not that tools miss findings, but that isolated findings miss the compound exposure created when permissions, data and AI systems interact.
Glossary terms: Context Layer, Toxic Combination Detection, Command Graph, Shared Risk Map
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Toxic combination risk is now a governance problem, not just a detection problem. Security teams already know how to find issues, but they still struggle to explain what those findings mean when combined across identity, cloud, data and AI. That shifts the control conversation from alert volume to relational context, because the exposure is often created by the interaction between otherwise ordinary findings. Practitioners should treat correlation as a core governance capability, not an optional analytics layer.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when AI governance, privacy and security teams disagree on risk?
A: They should establish a common evidence model and a shared decision rule for linked findings. Disagreement usually means each function is reading a different slice of the environment. A context layer helps teams move from separate interpretations to one governed view of assets, permissions and exposures, which is essential for consistent AI deployment decisions.
👉 Read our full editorial: Correlated evidence is the real test for data and AI risk
This post was modified 7 days ago by NHI Mgmt Group