Notifications
Clear all
Topic starter
11/06/2026 11:10 pm
TL;DR: AI systems are now part of the cloud attack surface, but traditional IAM, segmentation, and monitoring controls do not fully address model poisoning, inference abuse, prompt injection, or shadow AI, according to Orca Security. The practical gap is governance, not just tooling: security teams need inventory, ownership, lifecycle controls, and continuous monitoring for models and pipelines.
NHIMG editorial — based on content published by Orca Security: AI Security in the cloud
By the numbers:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems.
Questions worth separating out
Q: How should security teams govern AI systems in cloud environments?
A: They should govern AI systems the same way they govern other high-risk identity-bearing assets: establish ownership, inventory every model and endpoint, control access, and monitor behaviour continuously.
Q: Why do traditional IAM controls fall short for AI security?
A: Traditional IAM controls reduce exposure, but they do not address adversarial inputs, model poisoning, inference abuse, or output manipulation.
Q: How can organisations tell whether AI security controls are working?
A: Look for clear ownership, complete inventory, stable version history, and telemetry that catches abnormal inference activity or model drift.
Practitioner guidance
- Inventory AI assets continuously Create a living list of models, inference endpoints, training pipelines, and connected data stores across cloud and SaaS environments.
- Extend IAM to AI runtime surfaces Apply least-privilege access, network segmentation, and strong authentication to the infrastructure that AI uses, then add validation controls for inputs and outputs.
- Add adversarial testing to security validation Include prompt injection, poisoning, and inference abuse in red team exercises and risk assessments.
What's in the full article
Orca Security's full post covers the operational detail this post intentionally leaves for the source:
- The source article walks through step-by-step discovery and inventory of AI assets across cloud environments.
- It explains how Orca maps AI-specific risks such as model poisoning, prompt injection, and inference abuse into a security workflow.
- It outlines continuous monitoring signals for model drift, anomalous API activity, and configuration issues.
- It includes deployment-specific controls for network restrictions, access management, and data protection around AI workloads.
👉 Read Orca Security's analysis of AI security in cloud environments →
AI security in the cloud: what IAM teams need to know?
Explore further
12/06/2026 7:43 am
AI security is now an identity governance problem, not just a model security problem. Once AI services sit inside cloud workflows, the question becomes who can access them, who owns them, and how their privileges are tracked across their lifecycle. That makes the topic relevant to IAM, NHI, and cloud posture teams at the same time. The practitioner conclusion is simple: AI security fails when ownership and access governance are treated as separate disciplines.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to The 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to The 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between securing AI and using AI for security?
A: Securing AI protects models, data, and pipelines from attack. Using AI for security applies machine learning to improve detection, prioritisation, and response. Both matter, but they solve different problems. A mature programme needs controls for the AI system itself, not only AI-assisted security operations.
👉 Read our full editorial: AI security in cloud environments exposes gaps in IAM controls
