Topic starter
21/08/2025 9:07 am
TL;DR: Palo Alto Networks says its Unit 42 assessments focus on testing security controls against real-world threats, including AI security, compromise, cloud, ransomware readiness, SOC, tabletop and zero trust services, while warning that response models must keep pace as attack surfaces expand. The central issue is whether identity and response controls can withstand NHI-led attack paths.
Editorial analysis by NHI Mgmt Group, based on content published by Palo Alto Networks: “Unit 42 Cyber Threat Intelligence & Incident Response”.
By the numbers:
- Unit 42 says its team includes 200+ threat researchers who inform its incident response and cyber risk management services.
- Unit 42 says its incident response and digital forensics services support 1k+ incident response engagements a year.
- Unit 42 says its historical malware analysis grows by over 30 million malware samples per day analysed.
Key questions
Q: How should teams assess NHI risk when running AI security assessments?
A: Treat non-human identities as part of the attack surface, not as a background control detail.
Q: Why do AI safety benchmarks need identity and access review?
A: Because AI systems usually act through identities such as service accounts, tokens, and connectors.
Q: What breaks when non-human identities are not included in least privilege reviews?
A: When non-human identities are left out of least privilege reviews, access tends to accumulate quietly across service accounts, API keys, tokens, and automation workflows.
Practitioner guidance
- Test NHI credentials in every assessment Include service accounts, API keys, tokens, and certificates in compromise assessments so the review covers the identities attackers actually use to move laterally or persist.
- Map AI workflow access paths Inventory which AI-related services can inherit secrets or delegated access, then verify the downstream systems those credentials can reach before they are approved for production.
- Measure identity blast radius Rank privileged and machine identities by the amount of downstream access they unlock, then use that ranking to focus assessment and containment planning.
Bottom line: The article’s real subject is not AI tooling alone, but whether current security assessments test the identity paths that make compromise useful.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:40 pm
Assessment without identity scope leaves the real risk untouched: Security assessments that stop at posture, tooling, or cloud configuration miss the identity pathways that make compromise useful to an attacker. In NHI-heavy environments, the important question is whether the assessment exercises tokens, service accounts, delegated access, and privilege boundaries under realistic abuse conditions. If it does not, the organisation is measuring visibility, not exploitability. Practitioners should treat identity reachability as a required assessment dimension, not an add-on.
A few things that frame the scale:
- 13% of organisations suffered breaches of their AI models, according to IBM's Cost of a Data Breach 2025 report.
A question worth separating out:
Q: When does zero trust fail for machine identities?
A: Zero trust fails for machine identities when long-lived credentials still carry standing access and no one rechecks whether that access is still justified. If the workload can authenticate once and keep using the same secret indefinitely, the organisation has preserved a trust shortcut. Continuous verification is required for the model to hold.
👉 Read our full editorial: AI security assessments expose where NHI controls still break down