Notifications
Clear all
Topic starter
25/06/2026 10:23 pm
TL;DR: Agentic AI shifts cyber risk from human-paced intrusion to machine-speed systems that can plan, act, and adapt, according to RSA Security’s on-demand webinar. Current cybersecurity models are not built for autonomous attack chains, so governance, identity, and risk strategies now need to account for decision-making identities rather than just tools.
NHIMG editorial — here’s why we think this discussion matters
Questions worth separating out
Q: How should security teams govern AI agents that can act without human approval?
A: Security teams should govern autonomous AI as an identity actor with runtime decision authority, not as a simple application.
Q: Why do autonomous AI systems create more risk than conventional automation?
A: Autonomous AI creates more risk because it can decide what to do next, which tools to use, and when to act without waiting for a human gate.
Practitioner guidance
- Identify where autonomy enters the delegation chain Catalogue AI systems that can select actions at runtime without human approval, then map which identities, tools, and data sources they can reach.
- Separate policy presence from behaviour observability Verify that logs, alerts, and access records show what the autonomous actor did, not just which policy applied.
- Re-test least privilege against machine-paced execution Review whether any identity can chain actions faster than a human can intervene, especially where broad API scopes or inherited permissions exist.
What to expect at the briefing
RSA Security's full webinar covers the operational detail this post intentionally leaves for the source:
- How agentic AI compresses phishing, identity compromise, and post-compromise actions into machine-speed attack chains
- Where board-level blind spots appear when autonomy is granted without matching governance controls
- Why current cybersecurity models struggle to contain autonomous attacks once identity and decision authority converge
- What RSA says leaders should reconsider in governance, identity, and risk strategy as AI autonomy increases
👉 Watch RSA Security's on-demand webinar on why autonomous AI changes cyber risk →
Autonomous AI risk landscape: are current IAM controls enough?
Explore further
25/06/2026 10:53 pm
Autonomous AI turns identity governance from a review problem into a runtime control problem. Governance models built around periodic access review assume access persists long enough to be observed, challenged, and revoked. That assumption fails when an autonomous actor can select tools, act, and complete work within a single machine-paced session. The implication is that identity programmes must stop treating autonomy as an edge case and start treating runtime behaviour as the governing object.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an autonomous AI system abuses delegated access?
A: Accountability sits with the organisation that granted the delegation chain, but responsibility must be assigned to the programme that approved the actor’s runtime scope. If no one owns the identity, logging, and containment boundary together, accountability collapses between security, platform, and application teams.
👉 Read our full editorial: Autonomous AI changes the risk landscape for identity governance
