Topic starter
11/06/2026 11:28 pm
TL;DR: AI is now used in the cloud by 84% of organisations, while security teams that extensively use AI save an average of $1.9 million per breach, according to Orca Security and the 2025 Cost of a Data Breach Report. The deeper issue is that AI amplifies both detection and attack speed, so identity, access, and response controls must be built for machine-paced decision making.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “How AI is Changing Cybersecurity (for Good and Bad)”.
By the numbers:
- 84% of organisations now use AI in the cloud, according to Orca Security.
Key questions
Q: How should security teams handle cloud AI adoption without widening access risk?
A: Treat AI adoption as an identity governance issue, not only a tooling choice.
Q: Why do AI-fueled attacks increase the risk of compromise for cloud and identity controls?
A: AI lowers the effort needed to run phishing, exploit attempts, and malware campaigns at scale, so attackers can probe defenses continuously and adapt quickly.
Q: What breaks when cloud identity controls depend on human review speed?
A: Human-paced approval and review processes fail when attackers and defenders are both operating in seconds.
Practitioner guidance
- Limit cloud identity blast radius Reduce the scope of service accounts, API keys and workload roles so that exposed credentials cannot fan out across subscriptions, projects or tenants.
- Automate rapid containment for cloud compromise Use response logic that can isolate workloads, disable suspected identities and revoke tokens without waiting for human approval during active attack windows.
- Shorten exposure windows on secrets Rotate cloud keys, tokens and certificates aggressively enough that leaked credentials expire before automated attackers can exploit them.
Bottom line: AI is changing cloud security by speeding up both defensive response and attacker exploitation, which makes timing a governance issue as much as a technical one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 8:07 am
AI compresses the security decision loop faster than current cloud controls were designed to handle. The practical issue is not AI presence alone, but the fact that detection, prioritisation and response now happen in a shorter window than human governance cycles. That makes access review, manual escalation and delayed containment weaker control points than they used to be. Practitioners should treat decision latency as an identity and cloud security risk, not just an operational inconvenience.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations prioritise automated containment over manual escalation?
A: When the attacker can move from discovery to action faster than the team can convene a response. In cloud incidents involving leaked keys, phishing or adaptive malware, automated containment is often the only way to isolate workloads before damage spreads. Manual escalation still matters, but after the first containment move.
👉 Read our full editorial: AI is reshaping cloud security faster than current controls
This post was modified 1 day ago by NHI Mgmt Group