Topic starter
18/08/2026 2:20 pm
TL;DR: Black Hat USA 2026 is expected to centre cloud exploitation, SaaS vulnerabilities, identity-based attacks, and AI-driven risks, according to Safetica, reinforcing that visibility gaps across distributed data, non-human identities, and embedded AI workflows now shape the attack surface. The practical problem is governance drift, where controls lag behind how modern systems actually exchange data and privilege.
Editorial analysis by NHI Mgmt Group, based on content published by Safetica: “Cloud Data Protection Trends from Black Hat USA 2026”.
Key questions
Q: What breaks when SaaS sprawl is treated as a discovery problem instead of a governance problem?
A: Discovery alone cannot answer who owns an app, who still has access, or what happens to licenses and data when people move on.
Q: Why do cloud environments increase non-human identity risk?
A: Cloud environments increase non-human identity risk because automation, APIs, and service accounts multiply faster than manual review can keep up.
A: Common warning signs include unclear visibility across SaaS applications, slow response to risky configurations, and dependence on deep product expertise for each app.
Practitioner guidance
- Map SaaS applications to data owners and trust paths Build a current inventory of SaaS apps, third-party integrations, and automation routes that touch sensitive information, including shadow IT adoption.
- Audit non-human identities as first-class assets Review service accounts, tokens, and automation identities for scope, ownership, expiration, and revocation so machine access is governed like production access.
- Separate AI enablement from data approval Require review before enabling AI copilots or embedded LLM features in SaaS tools that can ingest regulated or confidential data.
Bottom line: The article's core message is that cloud risk is now shaped by the interaction of SaaS sprawl, machine identities, and AI-enabled workflows, not by infrastructure alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:12 pm
Cloud identity sprawl is now a governance problem, not just an inventory problem: the article shows that SaaS, APIs, automation, and AI are all increasing the number of identities that can reach sensitive data. That changes the security question from who owns the application to who controls the delegated access paths. The practical conclusion is that identity governance must extend beyond human accounts into every software actor with data reach.
A few things that frame the scale:
- 82% of breaches involved data stored in the cloud, according to IBM (2024).
A question worth separating out:
Q: Should organisations treat AI features in SaaS tools as a separate risk class?
A: Yes, because embedded AI changes how information is processed, summarised, and redistributed inside business workflows. Governance should distinguish ordinary application usage from AI-enabled data handling, especially where copilots or assistants can ingest regulated, confidential, or operationally sensitive content.
👉 Read our full editorial: Black Hat USA 2026 puts cloud identity and SaaS risk in focus