Topic starter
12/06/2026 9:47 pm
TL;DR: AI significantly expanded identities at 43% of organisations that reported a breach in the past 12 months, versus 11% where access patterns did not materially change, according to Netwrix Research Lab. Only 11% say they have full AI security readiness, showing governance and monitoring are lagging the pace of AI-driven access growth.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “2026 Data and Identity Security Report”.
By the numbers:
- 43% of organizations where AI significantly expanded identities reported a breach in the past 12 months, compared with 11% where AI had not materially changed access patterns.
- 76% of organizations do not fully govern or monitor non-human identities.
- 11% of organizations report full AI security readiness through continuous enforcement and monitoring.
Key questions
Q: How should security teams govern AI readiness across identity systems?
A: They should define AI readiness as a control problem, not a rollout problem.
Q: Why do AI-driven attacks increase risk for identity and access management programmes?
A: They increase risk because they compress the time between exposure and impact.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Inventory AI-linked identities Map every service account, token, credential, and delegated permission used by AI workflows.
- Classify high-risk access paths Mark identities that can reach sensitive data, production systems, or privileged APIs so they receive tighter approval, monitoring, and revocation rules.
- Move from periodic review to continuous monitoring Use runtime enforcement for AI-driven access where privilege changes too quickly for quarterly certification to be meaningful.
Bottom line: AI adoption is changing the identity problem itself by multiplying the number and pace of access paths that security teams have to govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
13/06/2026 12:06 am
AI identity expansion is really a governance compression problem: the more AI broadens access, the less useful human-paced review becomes as a control model. The article shows that breach rates rise where AI materially changes identity patterns, which means the programme risk is not just more access, but less time to govern it. Practitioners should read this as a lifecycle problem, not a tooling announcement.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between periodic access review and continuous AI audit?
A: Periodic access review checks whether a privilege is still justified after the fact, while continuous AI audit records access decisions and policy drift as they happen. For AI identities, that difference matters because privileges can change too quickly for retrospective review alone to be effective. Live evidence is needed to catch scope expansion before it becomes normalised.
👉 Read our full editorial: AI identity expansion is outpacing data security governance
This post was modified 4 days ago by NHI Mgmt Group