Topic starter
08/07/2026 6:59 pm
TL;DR: More than 700 security professionals report that 90% of organisations experienced an insider incident in the past year, 94% say AI is increasing exposure, and 54% report confirmed or suspected AI-related insider incidents, according to Gurucul's 2026 Insider Risk Report. The lesson is that insider risk has shifted from isolated events to continuous, cross-domain identity behaviour that legacy monitoring is not built to contain.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: “Gurucul Research Demonstrates AI is the New Insider Threat as 90% of Organizations Experience Incidents”.
By the numbers:
- 90% of organisations experienced at least one insider incident in the past 12 months, according to Gurucul.
- 94% of organisations say AI adoption is increasing their insider risk exposure, according to Gurucul.
- 54% of organisations acknowledge confirmed or suspected AI-related insider incidents, according to Gurucul.
Key questions
Q: What breaks when insider-risk programmes only monitor people and not AI agents?
A: Programmes miss the delegated layer where sensitive actions are increasingly executed.
Q: Why do machine identities increase financial control risk?
A: Machine identities increase financial control risk because they can operate with standing privilege, scale across systems and keep acting after the original business need has changed.
Q: How do security teams know if insider risk monitoring is actually working?
A: Look for fewer isolated alerts and more explainable investigations that end in proportionate action.
Practitioner guidance
- Map AI and machine identities into insider risk scope Inventory copilots, generative AI tools, service accounts, tokens, and automated workflows as insider-risk actors, not just infrastructure components.
- Unify behavioural and access telemetry Correlate identity events, workflow activity, and content access in one investigation path so analysts can see sequences rather than isolated alerts.
- Re-tune insider use cases for continuous activity Shift detection logic from single policy violations to behavioural patterns that unfold across cloud platforms, collaboration tools, and AI-assisted work.
Bottom line: AI-driven insider risk is not a new alert type, it is a change in what counts as an insider inside the enterprise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:23 pm
AI is no longer just an insider risk enabler, it is becoming an insider risk subject. That matters because the programme assumption that insiders are either human or clearly malicious no longer fits the operating reality described here. When AI sits inside delegated authority, the identity boundary itself becomes part of the risk surface, and insider governance has to reflect that.
A question worth separating out:
A: Security teams should treat AI prompts, file attachments, responses, and downstream actions as part of the same investigative record as human messages. The goal is to reconstruct intent and context, not just detect a flagged event. Correlating AI activity with communications, data, and logs helps investigators decide whether behavior was routine, careless, or part of a broader pattern.
👉 Read our full editorial: AI as an insider threat is exposing gaps in risk models