Topic starter
18/08/2026 2:23 pm
TL;DR: Automated risk will shift in 2026 from simple bot blocking to behavioural governance, as declared LLM scraping and agentic browsing increasingly drive economic extraction, pricing distortion, and delegated automation risk, according to Netacea. The critical change is that identity alone cannot control systems that adapt in real time; intent and behaviour must become the primary control signals.
Editorial analysis by NHI Mgmt Group, based on content published by Netacea: “The 2026 Forecast for AI-Driven Threats”.
Key questions
Q: What breaks when automation is governed only by identity labels?
A: Identity labels cannot show whether an AI agent or crawler is extracting value, distorting pricing or repeating sensitive actions at scale.
Q: Why do declared crawlers and AI agents create economic risk even when they are authorised?
A: Authorisation proves access, not intent.
Q: What are the signs that behavioural governance is failing for automated traffic?
A: Look for rapid expansion across sensitive content, repeated revisits, concentration on pricing or inventory pages, and agent workflows that keep optimising after the original purpose is complete.
Practitioner guidance
- Define behavioural access policies for automated actors Set separate policy paths for declared crawlers, AI agents and delegated workflows, with thresholds for content sensitivity, revisit frequency and commercial impact.
- Add runtime intent signals to access decisions Use sequence, asset selection and repetition patterns to decide when an automated session remains within approved purpose and when it needs verification or restriction.
- Treat delegated automation as governed access Map agentic browsing and synthetic identities into IAM and NHI controls so that access reviews, approvals and offboarding include non-human actors.
Bottom line: Identity-only controls are no longer sufficient for automation that adapts in real time and interacts directly with business systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:14 pm
Behaviour, not identity, is becoming the primary security boundary for automation. Identity tells teams who requested access, but it does not tell them whether the activity is extraction, optimisation or abuse. Once AI agents and crawlers can behave credibly at the point of access, runtime behaviour becomes the decisive control signal. For practitioners, the governance question shifts from authentication confidence to intent and outcome.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern agentic browsing without blocking useful automation?
A: Use conditional access, step-up verification and policy tiers that reflect purpose, sensitivity and repetition, rather than broad allow or deny rules. The goal is to preserve search, partner and user-driven automation while constraining activity that crosses commercial or security thresholds.
👉 Read our full editorial: AI-driven automation needs behavioural governance, not identity alone