Notifications
Clear all
Topic starter
11/08/2026 3:14 pm
TL;DR: AI is compressing attack timelines and making identity recovery central to cyber resilience, with Semperis citing Australian organisations that expect more frequent identity attacks and only 32% worldwide believing they could regain control if an AI agent exposed admin credentials. The real test is no longer backup alone, but whether identity can be restored cleanly and fast enough to keep the business operating.
NHIMG editorial — based on content published by Semperis: AI-accelerated cyber risk, identity resilience, and board readiness
By the numbers:
- Only 32% of organisations worldwide believe they could regain control if an AI agent exposed admin credentials.
- 80% of Australian respondents expect that AI will make identity attacks more frequent.
Questions worth separating out
Q: How should security teams prove identity recovery is real, not assumed?
A: They should run recovery tests that restore identity to a trusted operational state, not just bring systems online.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: What fails when organisations rely on backup alone for Active Directory?
A: Backup alone can fail because it does not prove the restore is clean, trusted, or sequenced correctly for business use.
Practitioner guidance
- Validate clean identity recovery Test whether Active Directory and hybrid identity can be restored to a known-clean state, with evidence that attacker persistence, rogue memberships, and delegated privilege changes are removed before services return.
- Measure recovery against business RTO Run recovery exercises against the actual recovery time objective for critical applications, not a generic IT target, and verify that identity services come back in the order the business needs.
- Reduce privileged identity exposure paths Identify Tier 0 attack paths, stale admin access, and risky delegation chains, then remove or narrow them before an AI-assisted attacker can chain them together.
What's in the full article
Semperis' full article covers the operational detail this post intentionally leaves for the source:
- The regional Semperis survey breakdown showing how Australian and global organisations are thinking about AI-driven identity risk.
- The board-level question set Semperis uses to frame identity recovery, crisis readiness, and business continuity.
- The operational distinction between backup, known-clean recovery, and minimum viable company restoration.
- The supporting context around Semperis recovery and incident response services for hybrid identity environments.
👉 Read Semperis' analysis of AI-driven identity risk and recovery readiness →
Identity recovery under AI pressure: is your resilience plan real?
Explore further
11/08/2026 3:27 pm
Identity resilience is now a board issue because the control plane is also the recovery dependency. AI does not just make attacks faster. It makes the identity layer more fragile because the same directory services that enable access also anchor business continuity. That means a failure in identity governance becomes an operational failure, not just an authentication problem. Boards should treat identity recovery as a resilience capability that must be demonstrated, not assumed.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when a recovery identity is compromised?
A: Accountability sits with the team that owns the recovery workflow and the control that allowed standing privilege or unmanaged secrets to persist. IAM, PAM, and BCDR cannot be separated in practice. If the credential can restore operations, it is a production-grade privileged identity and must be governed accordingly.
👉 Read our full editorial: AI is compressing identity recovery timelines for enterprise resilience
