Topic starter
18/08/2026 2:23 pm
TL;DR: Automated risk in 2026 will shift toward behavioural governance because declared LLM scraping and agentic browsing can drive economic extraction and pricing distortion, according to Netacea. Systems need runtime signals for intent, sequence and thresholds, not just declared identity.
Editorial analysis by NHI Mgmt Group, based on content published by Netacea: “The 2026 Forecast for AI-Driven Threats”.
Key questions
Q: Why do declared crawlers and AI agents create economic risk even when they are authorised?
A: Authorisation proves access, not intent.
Q: What are the signs that behavioural governance is failing for automated traffic?
A: Look for rapid expansion across sensitive content, repeated revisits, concentration on pricing or inventory pages, and agent workflows that keep optimising after the original purpose is complete.
Q: What breaks when automation is governed only by identity labels?
A: Identity labels cannot show whether an AI agent or crawler is extracting value, distorting pricing or repeating sensitive actions at scale.
Practitioner guidance
- Define behavioural access policies for automated actors Set separate policy paths for declared crawlers, AI agents and delegated workflows, with thresholds for content sensitivity, revisit frequency and commercial impact.
- Add runtime intent signals to access decisions Use sequence, asset selection and repetition patterns to decide when an automated session remains within approved purpose and when it needs verification or restriction.
- Treat delegated automation as governed access Map agentic browsing and synthetic identities into IAM and NHI controls so that access reviews, approvals and offboarding include non-human actors.
Bottom line: Identity-only controls are no longer sufficient for automation that adapts in real time and interacts directly with business systems.
Glossary terms: Runtime Behavioural Governance, Agentic Traffic, Bot and Agent Trust Management, Delegated Automation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:14 pm
Behaviour, not identity, is becoming the primary security boundary for automation. Identity tells teams who requested access, but it does not tell them whether the activity is extraction, optimisation or abuse. Once AI agents and crawlers can behave credibly at the point of access, runtime behaviour becomes the decisive control signal. For practitioners, the governance question shifts from authentication confidence to intent and outcome.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern agentic browsing without blocking useful automation?
A: Use conditional access, step-up verification and policy tiers that reflect purpose, sensitivity and repetition, rather than broad allow or deny rules. The goal is to preserve search, partner and user-driven automation while constraining activity that crosses commercial or security thresholds.
👉 Read our full editorial: AI-driven automation needs behavioural governance, not identity alone