Notifications
Clear all
Topic starter
21/08/2026 5:00 pm
TL;DR: AI is moving into production faster than many security programmes can adapt, and AccuKnox argues that zero trust must extend beyond applications to models, prompts, data, pipelines, and runtime controls. The operational gap is not AI novelty but fragile posture, over-permissioned identities, unmanaged secrets, and blind execution paths that allow small failures to scale.
NHIMG editorial — based on content published by AccuKnox: How To Deploy AI Fast While Maintaining Zero Trust Security
By the numbers:
- 78% of organisations are using AI in 2026, according to McKinsey Global Survey.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams govern AI experimentation without slowing delivery?
A: Use lane-based governance.
Q: Why do AI pipelines increase the risk of privilege creep?
A: AI pipelines blend human users, service accounts, workload identities, and agents across one delivery path, so permissions accumulate quickly if roles are not separated by function.
Q: What breaks when zero trust stops at posture management?
A: A workload can still execute harmful actions even when the configuration looks clean.
Practitioner guidance
- Inventory every AI asset before expanding deployment Map models, notebooks, endpoints, pipelines, and agent-connected services so access policies and monitoring can be attached to a real inventory rather than assumptions.
- Split human and non-human roles by function Define separate access paths for data engineering, ML engineering, platform operations, production release, and security so one compromised identity cannot cross all operational boundaries.
- Apply just-in-time elevation for high-risk AI actions Reserve temporary privilege for model promotion, endpoint exposure, and secrets rotation, and make approval and logging part of the task boundary.
What's in the full article
AccuKnox's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on AI-SPM discovery, posture management, and runtime enforcement across cloud and Kubernetes environments.
- Practical examples for separating roles across data engineering, ML engineering, platform operations, and production release.
- Details on zero trust CNAPP, KSPM, and CWPP use in AI workloads, including runtime telemetry and policy enforcement.
- Continuous compliance coverage across more than 30 frameworks for regulated environments.
👉 Read AccuKnox's guide to deploying AI fast with zero trust security →
AI and zero trust: are identity and runtime controls keeping up?
Explore further
21/08/2026 5:16 pm
AI speed turns identity from a back-end control into the primary security boundary: once model training, inference, and agentic workflows enter production, the old assumption that identity is mostly about users breaks down. Human actors are only one part of the access graph; service accounts, workload identities, API keys, and agent credentials now shape blast radius. Practitioners should treat identity governance as the operating system for AI delivery, not as a compliance afterthought.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when an AI-assisted workflow leaks sensitive data?
A: Accountability sits with the organisation that allowed the workflow to operate outside governed controls. Security, IAM, and business owners all share responsibility for ensuring approval, logging, and lifecycle management exist before data moves through the path. If no one can block or revoke it, no one is governing it.
👉 Read our full editorial: AI delivery at speed requires zero trust across identity and runtime
