Topic starter
24/06/2026 8:42 pm
TL;DR: 37% of organisations changed their security approach after AI-driven attacks, according to Netwrix’s 2025 Cybersecurity Trends Report, while 29% now say auditors require proof of data security and privacy in AI-based systems. The pressure point is no longer whether AI matters, but whether identity and data governance can keep pace with AI-amplified attack speed.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “Netwrix Research: Over One-Third of Organizations Adjust Security Strategies in Response to AI-Driven Threats”.
By the numbers:
- 37% of organisations said AI-driven attacks forced them to adjust their security approach over the past year.
- 30% say their business uses AI and must now protect it like any other critical system.
- 29% report auditors now require proof of data security and privacy in AI-based systems.
Key questions
Q: What breaks when AI attacks move faster than security teams can review access events?
A: Manual access review and slow triage break first.
Q: Why do AI-based systems create new audit expectations for data security?
A: Because auditors need proof that the organisation can control and evidence access to sensitive data, not just state that it has a policy.
Q: How should security teams govern AI in cybersecurity operations?
A: Security teams should govern AI in cybersecurity operations as a workflow control, not just a detection feature.
Practitioner guidance
- Map AI system identities and access paths Inventory every service account, token, and integration that can reach AI workloads or the data they use.
- Separate AI access from broad production permissions Restrict AI-connected identities to the smallest feasible data and system scope, especially where assistants, analytics, or automation tools can retrieve sensitive records at runtime.
- Build audit evidence from actual access events Capture who or what accessed AI-related data, when the access occurred, and which control approved it.
Bottom line: AI-driven attacks are no longer just a threat to endpoint or email security. They are changing how organisations think about identity, data exposure, and governance evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:27 am
AI-driven threats are collapsing the time available for identity governance. Traditional access review and remediation cycles assume defenders can observe misuse after it begins and before damage spreads. When attackers can automate discovery, abuse, and follow-on action more quickly, the control problem shifts from periodic review to real-time governance.
A question worth separating out:
Q: Should organisations prioritise identity controls or SOC automation first for AI threats?
A: Prioritise the control that closes the fastest path to misuse in your environment. If AI attacks are landing through identity abuse, improve authentication, privilege restriction, and session containment first, then use SOC automation to speed triage and response. The two work best together, but identity containment usually comes first.
👉 Read our full editorial: AI-driven threats are reshaping identity and data security strategies