Topic starter
10/07/2026 9:12 pm
TL;DR: Agentic AI is widening the human-risk problem as 68% of breaches still involve people, 82.6% of phishing emails now use some form of AI, and 43% of workers admit sharing sensitive information with AI tools without permission, according to Drata and its cited research. Static awareness training is no longer enough when both humans and AI agents influence access, behaviour, and audit evidence.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The Evolution of Human and AI Risk in the Age of Agents: Drata x KnowBe4”.
By the numbers:
- 68% of data breaches involving people shows how heavily security outcomes still depend on human behaviour, according to Drata.
- 82.6% of phishing emails now use some form of AI, according to Drata.
- 43% of workers admit to sharing sensitive information with AI tools without permission, according to Drata.
Key questions
Q: How should security teams unify human and AI agent risk management across the workforce?
A: Security teams should use one risk model for both people and AI agents, because both can hold identity context, permissions, and access to data.
Q: Why do static awareness programmes fail against AI-driven social engineering?
A: Static programmes fail because they train for yesterday’s attack patterns and ignore real-time risk.
Q: What do organisations get wrong about shadow AI governance?
A: They often try to block unsanctioned tools at the network layer without changing employee behaviour or providing an approved alternative.
Practitioner guidance
- Build a unified human and AI risk model Map user behaviour, shadow AI usage, and delegated agent activity into one risk register so exposure is assessed across the full digital workforce.
- Replace annual awareness checks with continuous measurement Use behavioural telemetry, phishing simulation results, and interaction data to identify the riskiest individuals and workflows in real time.
- Automate evidence capture for training and behaviour controls Connect awareness, simulation, and remediation records to audit evidence workflows so compliance teams are not rebuilding proof manually.
Bottom line: Agentic AI does not replace the human-risk problem, it amplifies it by adding a new layer of behaviour, delegation, and exposure that existing security programmes often do not measure well.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:35 pm
Agentic AI is now part of the human-risk problem, not a separate sidebar. Once AI tools are embedded in daily work, the boundary between user behaviour and system behaviour becomes operationally irrelevant. Security programmes that still separate “human awareness” from “machine control” will miss how AI changes both the pace and the shape of risky decisions. The practical conclusion is to govern behaviour, delegation, and evidence as one programme.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do security and compliance teams prove that behaviour-based controls are working?
A: Look for evidence that risk scores, training records, and remediation actions are updating continuously rather than sitting in disconnected systems. If the programme cannot show who changed behaviour, what triggered the intervention, and whether the control reduced exposure, then it is tracking activity but not proving risk reduction.
👉 Read our full editorial: Agentic AI and human risk are converging in security programmes