Topic starter
20/08/2026 5:39 pm
TL;DR: AI will expand attack surfaces faster than defenders can rework controls, especially around machine identity, API keys, and agentic tooling, while attackers keep exploiting weak identity verification and access management, according to Expel's 2026 predictions. The governing problem is not AI itself, but the persistence of long-lived credentials and the visibility gap they create.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Our cybersecurity predictions for 2026”.
Key questions
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers.
Q: Why do long-lived secrets create more risk in agentic environments?
A: Long-lived secrets are dangerous because they can be copied, reused, and hidden inside code or orchestration layers for long periods.
Q: What do security teams get wrong about AI access risk?
A: Many teams focus on the model while ignoring the identity path that reaches it.
Practitioner guidance
- Map every non-human credential to an accountable owner Build a single inventory for API keys, service accounts, tokens and certificates used by AI tools, workloads and integrations, then require an accountable business or technical owner for each one.
- Bind agent access to narrow task-scoped delegation Replace broad inherited privileges with explicitly approved, task-scoped permissions for agent workflows, and review every tool connection against the minimum access needed for the task.
- Shorten the lifetime of reusable secrets Prioritise rotation and revocation for long-lived credentials that are shared across multiple systems, especially where the same token or key can reach production or customer data.
Bottom line: AI agents and machine identities are widening enterprise attack surfaces because they multiply delegated access paths faster than security teams can inventory and constrain them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:23 pm
Machine identity sprawl is becoming the practical attack surface of AI adoption. The article points to a familiar pattern: interoperability expands faster than governance, and the first thing to break is usually not the model but the identity layer behind it. In NHI terms, the challenge is ownership, inventory and lifecycle control for non-human access that keeps multiplying across tools and workflows. Practitioners should treat machine identity sprawl as an access-governance problem, not an AI novelty.
A question worth separating out:
Q: When should organisations separate human and machine identity controls?
A: They should separate them as soon as service accounts, API keys, or cloud tokens carry meaningful access, because machine identities fail differently from user accounts. Human login controls do not prevent a leaked application key from being replayed, so the lifecycle and monitoring model has to change.
👉 Read our full editorial: AI agents and machine identities will widen 2026 attack surfaces