Topic starter
01/08/2026 10:50 pm
TL;DR: As AI copilots, assistants and autonomous agents become embedded in workflows, attackers are targeting the human-AI interaction layer through prompt injection, impersonation and social engineering, according to KnowBe4. The security gap is no longer just access control, but governance for how humans and AI systems influence each other in production.
Editorial analysis by NHI Mgmt Group, based on content published by Knowbe4: “Whitepaper Securing the Hybrid Workforce: Protecting Humans and AI Agents in a New Era”.
Key questions
Q: What breaks when AI platform access is managed like ordinary user access?
A: What breaks is the assumption that access is stable, human-owned, and easy to review in a later cycle.
Q: Why do AI copilots and agents increase social engineering risk in enterprise workflows?
A: They compress trust into a faster decision path.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Inventory AI touchpoints across workflows Map where copilots, assistants and autonomous agents are embedded in production processes, including chat, email, code and ticketing systems.
- Restrict delegated action scope Define exactly which data sources, applications and actions each AI system may access, and deny anything outside that approved scope.
- Add provenance to AI-generated content Mark AI-generated outputs and high-risk instructions so users can distinguish machine-authored text from human requests before acting.
Bottom line: The core risk is not just that AI systems can be compromised, but that they can be used to influence human decisions inside normal business workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
Dual governance is now the right model for enterprise AI risk: organisations must govern both the human user and the AI system as interacting trust subjects. Traditional identity controls assume a person or service authenticates, then acts within a bounded session. That model misses prompt-level influence, synthetic output trust and delegated machine action. Practitioners should treat the human-AI interface as a governed control surface, not a productivity feature.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between AI discovery and AI governance?
A: AI discovery answers what exists in the environment, while AI governance decides what should be allowed, restricted, or blocked. Discovery is an inventory control. Governance adds context, policy, enforcement, and monitoring so the organisation can manage AI risk after the first finding is made.
👉 Read our full editorial: Securing the human-ai attack surface now needs dual governance