Topic starter
11/08/2026 3:14 pm
TL;DR: AI is compressing attack timelines and making identity recovery central to cyber resilience, with Semperis citing Australian organisations that expect more frequent identity attacks and only 32% worldwide believing they could regain control if an AI agent exposed admin credentials. The real test is no longer backup alone, but whether identity can be restored cleanly and fast enough to keep the business operating.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “How the Five Eyes AI Warning Changes Board Thinking About Cyber Recovery and Resilience”.
By the numbers:
- Only 32% of organisations worldwide believe they could regain control if an AI agent exposed admin credentials.
- Australian respondents said 80% expect that AI will make identity attacks more frequent.
Key questions
Q: What breaks when organisations rely on backup without proving clean identity recovery?
A: Backup alone can restore services while preserving attacker state, including privileged changes, rogue memberships, or other identity-layer persistence.
Q: Why does AI make identity security a resilience issue?
A: AI raises the operational tempo around access decisions, which means identity failures can affect containment, recovery, and continuity, not just initial compromise.
Q: How do organisations know if their identity recovery plan is actually working?
A: The strongest signal is whether authentication can be restored from clean backups without reintroducing malicious changes or broken trust relationships.
Practitioner guidance
- Test identity recovery to a known-clean state Run recovery exercises that prove Active Directory and hybrid identity can be restored without carrying forward privileged persistence, rogue memberships, or other attacker changes.
- Measure recovery against business RTO Validate whether identity services come back in the order and at the scale the business actually needs, rather than stopping at a successful technical restore.
- Map Tier 0 identity dependencies Identify the privileged paths and identity relationships that would block email, collaboration, application access, and crisis coordination if they failed.
Bottom line: AI-accelerated threats are exposing a basic resilience gap: many organisations can back up identity infrastructure, but fewer can restore it to a trusted state fast enough to keep the business operating.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:27 pm
Identity recovery is now a control-plane problem, not a backup problem: AI has reduced the time available to detect and contain identity compromise, which means the organisation’s ability to restore a trusted identity state matters more than whether copies exist. Backup without proof of clean restore only recreates uncertainty faster. The practitioner conclusion is simple: resilience must be measured at the identity layer, where business continuity actually starts.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when crisis management depends on identity systems that may be unavailable?
A: They should separate response coordination from the systems being recovered by using an out-of-band channel for executives, responders, and technical owners. If the identity stack is down, the incident team still needs a reliable way to make decisions, share status, and direct recovery without waiting for normal access to return.
👉 Read our full editorial: AI is compressing identity recovery timelines for enterprise resilience