Topic starter
09/07/2026 12:36 pm
TL;DR: AI is lowering the activation energy for expertise, customization, and code generation, which can weaken the old economies-of-scale model that security programmes were built around, according to Knostic and Sounil Yu’s remarks at the SANS 2025 Government Security Forum. The governance challenge is no longer just controlling access at scale, but preserving control as systems become more distributed, ephemeral, and customised.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “AI as an Enzyme to Transform Critical Infrastructure”.
Key questions
Q: How should security teams govern AI-driven customisation without losing control?
A: Security teams should govern AI-driven customisation by treating generated code, workflows, and access paths as managed assets with explicit ownership and policy checks.
Q: Why do standardised controls become weaker in highly customised AI environments?
A: Standardised controls become weaker when AI makes bespoke workflows cheap enough to proliferate faster than governance can normalise them.
Q: What breaks when access is ephemeral rather than durable?
A: Review-based governance breaks when access exists for too short a period to be meaningfully certified after the fact.
Practitioner guidance
- Map where standardisation is now a liability Identify parts of the environment where AI-driven customisation has made uniform controls less reliable, especially in access design, review cycles, and dependency governance.
- Reassess controls built for durable entitlements Review whether certification, recertification, and periodic review workflows still make sense where access and artefacts may exist only briefly.
- Separate provenance controls from component inventory Track whether the organisation still depends on software composition assumptions when AI systems increasingly generate bespoke outputs and code paths.
Bottom line: AI changes security economics by making expertise and customisation cheaper, which weakens the old assumption that standardisation is always the safest operating model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:42 pm
AI is eroding the control value of monoculture. The long-held security preference for standardisation assumes that fewer variants mean fewer governance problems. AI weakens that premise by making expertise and customisation cheap enough to proliferate, which means security teams inherit more bespoke paths, not fewer. The implication is that identity governance has to measure control consistency across variation, not simply celebrate reduced platform diversity.
A question worth separating out:
Q: How do teams decide between standardisation and diversity in AI security?
A: The decision is not absolute. Standardisation still helps with oversight, but excessive uniformity can create systemic fragility, while too much diversity can erode consistency and visibility. Teams should choose the level of standardisation that limits blast radius without forcing every workflow into the same operating pattern.
👉 Read our full editorial: AI scale is changing cybersecurity assumptions in enterprise governance