Topic starter
15/08/2026 6:07 pm
TL;DR: AI-related attacks rose nearly 490% year over year, while enterprises now average 139+ AI-enabled SaaS applications and 23,021 SaaS apps outside centralized visibility, according to Grip Security’s 2026 SaaS + AI Security Report. The governance gap is shifting from model oversight to identity, OAuth, and access-path control, which makes unmanaged non-human identities the operational weak point.
Editorial analysis by NHI Mgmt Group, based on content published by Grip Security: “AI Governance Statistics for 2026: Trends, Risks & Enterprise Data”.
By the numbers:
- AI-related attacks increased approximately 490% year over year, according to Grip Security.
Key questions
Q: What breaks when identity mapping is treated as enough for AI governance?
A: What breaks is the assumption that knowing an agent’s owner means the organisation can trust the agent’s behaviour.
Q: Why do OAuth connections make AI governance harder to manage?
A: OAuth turns AI governance into a delegated access problem because applications inherit scoped permissions that can outlive the security intent behind them.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Map AI-enabled SaaS to live identity grants Inventory every AI-enabled SaaS application, then map the OAuth scopes, delegated permissions, and service accounts that allow it to act across enterprise data and workflows.
- Review and constrain risky OAuth permissions Prioritise mail, file, content-modification, and long-lived delegated access grants, because those are the permissions most likely to turn AI convenience into persistent exposure.
- Extend governance to non-human identities Include automation credentials, APIs, machine identities, and browser extensions in the same governance workflow used for human accounts, with ownership, review, and offboarding requirements.
Bottom line: AI governance in enterprise environments is increasingly an identity and access problem rather than a model-risk problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:16 pm
AI governance debt is really identity governance debt: enterprises are attempting to control distributed AI adoption with governance models built for centralised systems. That model fails when access is created through SaaS integrations, delegated scopes, and machine identities that operate outside normal review cycles. The governance gap is not abstract, it is structural, and it puts IAM, PAM, and NHI teams at the centre of AI risk management.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat non-human identities differently from human users in governance?
A: Yes. Non-human identities usually change faster, operate at higher volume, and are owned by systems rather than people. That means they need different review cadence, stronger lifecycle controls, and tighter evidence collection. A human-centric IAM process will miss much of the machine access risk.
👉 Read our full editorial: AI governance risk is really an identity governance problem