AI inherits your identity debt – and pays it back with interest
Here's the number that should stop any AI roadmap in its tracks:
In IBM's 2026 Cost of a Data Breach Report, among the organisations that suffered a breach involving their own AI, 92% had no proper access controls on it. Not weak controls. None.
IBM's Cost of a Data Breach Report 2026 found that of organisations breached through their AI, 92% lacked proper access controls and 68% had no AI governance policy in place. Separately, "shadow AI" (staff using unapproved AI tools) showed up in 43% of security incidents, more than double the year before, and ranked among the three biggest drivers of breach cost.
Read those together and a picture forms. Organisations aren't losing to some exotic new class of AI attack. They're deploying AI on top of identity foundations they never finished building, and the AI is quietly finding every gap. Which is the point I’d like to make: AI doesn't introduce a new security problem. It walks into the one you already had and turns the volume up.
I've started calling it identity debt – the accumulated mess most estates carry and keep meaning to sort. The leavers whose accounts still work. The service principals nobody remembers creating. The roles that grew three sizes because it was easier than scoping them. The shared secret in a config file. You could live with identity debt when the things holding those permissions were slow, human, and mostly sensible. AI changes all three. It acts at machine speed, without judgement, on exactly the access you gave it, and it does so thousands of times a day.
An AI agent is just an identity with ambition
Strip away the mystique and an AI agent is a non-human identity. It has credentials. It holds permissions. It acts on someone's behalf. Every question you'd ask about a member of staff (who is this, what can it reach, who approved that, how do we switch it off) applies to an agent, except an agent never gets tired, never gets suspicious, and never stops to think "should I really be able to do this?"
That's why the old, unglamorous failure modes matter more now, not less. An over-privileged agent is the confused deputy problem at scale: give it broad standing access "to be safe," and you've built something with a human's reach, a machine's speed and none of the instinct to stop when a request feels wrong. The fix isn't novel. It's least privilege, scoped and revocable, applied to agents exactly as you'd apply it to people, plus the ability to prove afterwards which agent did what, on whose authority. IBM's own framing in the 2026 report is blunt about this: securing what they call agentic identities means "tightly scoped permissions continuously enforced at runtime, human attribution and auditability." None of that is an AI capability. It's identity hygiene, pointed at a new kind of user.
Your AI knows whatever the identity it runs as can reach
The part that catches people out is grounding. The moment you connect an assistant to your documents, your tickets, your patient records, your finance system, you've made a decision about identity whether you meant to or not: the AI can surface anything the identity it runs under can reach.
Ground an agent on "all of SharePoint" under a service account with broad rights, and you haven't built a helpful assistant, you've built a search engine that cheerfully ignores every permission boundary you spent years enforcing. Ask it the wrong question and it will happily read out the salary spreadsheet. The answer isn't an AI content filter bolted on top. It's identity-scoped retrieval: the agent sees what the invoking user is entitled to see, and not a byte more, because entitlement is checked at the data, in the moment, against a real identity.
Shadow AI is ungoverned identity wearing a friendly face
That 43% shadow-AI figure isn't really a story about AI. It's a story about identities and data flows you can't see. Every time someone pastes a contract into an unsanctioned tool or wires a personal AI account into a workflow, they've created an access path you don't govern, can't audit, and won't be able to revoke. This is the same shadow-access problem the industry has wrestled with for years, now with a compelling reason for staff to solve it.
You don't fix it with a memo. You fix it the way you fix any identity-visibility gap: give people sanctioned, well-governed AI that's genuinely easier to use than the rogue alternative, put it behind the same authentication and conditional access as everything else, and make sure anything an approved tool touches is logged against a real identity. Shadow AI thrives in exactly the places identity governance is thin. Thicken it, and most of the problem stops being worth the effort to route around.
The precondition is boring, and that's the point
Here's the deflating truth for anyone hoping to buy their way to safe AI: there is no AI security product that saves you from skipping the basics. The organisations that will scale AI without a reckoning are the ones that did the homework first, and the homework is the same list it always was:
Lifecycle you can trust. Joiner-mover-leaver automation, for humans and the workloads and agents they spawn, so access reflects reality and nothing outlives its purpose.
Least privilege by default. Scoped, time-boxed, reviewed – for a service principal and an AI agent just as much as for an admin.
No standing secrets. Kill the shared credentials and the keys in config files; use managed and federated workload identities so nothing authenticates with a password an attacker can lift.
Strong, contextual authentication. MFA and conditional access as the front door to every tool, sanctioned AI included.
Attribution and audit as a by-product. Every action (human or agent) traceable to an identity, without a fortnight's archaeology.
None of that’s new. All of it is exactly what most estates have been deferring. AI just moved the deadline.
Azure: the same controls, pointed at agents
For organisations already on Microsoft, the good news is you don't need a separate identity stack for AI, you just need to extend the one you have. Managed identities and workload identity federation let agents and services authenticate without secrets in code. Conditional Access governs who and what can invoke a tool, under which conditions. Privileged Identity Management brings just-in-time, approved elevation to non-human identities that need sensitive reach only occasionally. Entra ID Governance runs the lifecycle and access reviews. And because grounding is a data-access question, pairing that identity layer with proper information-protection and access controls on the source data is what stops an assistant becoming a leak. The capabilities are mature. What's usually missing is someone deliberately turning them on the agents, rather than only the people.
Final thought
I've argued across this series that identity is the perimeter we actually defend, and that getting it right pays a measurable dividend. AI is where those two ideas collide and stop being optional. You can’t deploy AI widely on a shaky identity foundation, or rather, you can, and 92% of the organisations breached through their own AI just showed you how that ends.
The uncomfortable, unglamorous, entirely good news is that there's no separate "AI security" project waiting for you. There's just the identity work you already owed, now with a deadline and a very good reason to finally do it. Pay down the identity debt, and AI becomes the thing it was supposed to be: an amplifier of everything you do well, rather than everything you left undone.
Do the boring bit. Then go fast.