Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI has removed the skill, personalization, and speed barriers that once limited cyberattacks. Attackers use language models at every stage of the kill chain, from recon to persistence, and underground tools sell pre-jailbroken access to mainstream models for as little as $50 a week. But because every attack still has to change a file, a configuration, or a script on a real system, detecting unplanned change works no matter which model wrote the payload.

Data masking limits unnecessary exposure when teams copy sensitive production values into testing, analytics, and sharing workflows. It replaces those values with realistic substitutes, but weak implementations still permit inference, linkage, or reversal. Effective programs select techniques based on downstream use and test each output against its intended workflow.

As AI agents spread across IT environments, organizations struggle to see what agents they have and what data those agents can access. For Cybersecurity Awareness Month, we wanted to share what Netwrix is doing to help IT and security teams improve agentic AI visibility and governance to keep their sensitive data secure. I recently sat down with Jeff Warren, our chief product officer, who has been working through this problem with customers for a while.

A local password manager stores your credentials in an encrypted vault on your own device or server. You control your data and backups, but you also manage keys and updates yourself. That works for one person. Teams need role-based access, approvals for sensitive accounts, and logs that show who accessed what.

A data risk assessment evaluates where sensitive data lives, who can reach it, and what happens if that access is misused. It creates value only when teams assign and track remediation; without current access data and live verification, organizations can't show that exposure has fallen. 75% of sensitive data exposures begin with compromised identities or misconfigured permissions, according to the Netwrix 2026 Data and Identity Security Report.

Remote code execution (RCE) lets an attacker run commands on a system they don't own, usually through a flaw in a web application, CMS, VPN portal, or API. A successful exploit inherits the permissions of the vulnerable service, and many services run with far more access than they need. AI shortens the time from a disclosed flaw to a working exploit and lets attackers test thousands of exposed systems at once. A remote code execution flaw turns a vulnerable server into someone else's computer.

Proactive security means measuring your posture against clear policies on a steady rhythm and fixing risk before it becomes an alert or an audit finding. Most teams still work reactively: they wait for an auditor or an alert, investigate, and then act. SOC 2, ISO 27001, and NIST CSF already expect ongoing improvement. Getting there takes a shift in mindset and tools that make the rhythm easy to keep.

AI agents are multiplying faster than most organizations can track, let alone govern. IDC predicts there will be 1.3 billion agents by 2028. Every team that adopts one is also, often without meaning to, creating a new identity. And it’s one that can access systems, move data, and act on someone's behalf. The rush right now is to get ahead of that before it spirals, and the first step is to answer a basic question: whose job is this?

Part 2 of 3 in our Rethinking Privileged Access series. Start with Part 1: The password was never the only problem. In Part 1, we drew the line between the vault-and-checkout model of legacy PAM and the session-and-Activities model of modern PAM with Netwrix Privilege Secure (NPS). One protects the password; the other eliminates the standing privilege behind it. That framing is a good starting point, but it understates the case. In Windows and Active Directory, the password is just the seed.

Service accounts, app integrations, and AI agents often have more access than any person, and they get reviewed last. That gives them one of the largest blast radiuses in the environment, meaning they can reach more if they're compromised. The Uber and Cloudflare breaches and the Salesloft Drift campaign against Salesforce customers show how attackers exploit these accounts. Check them for open, stale, orphaned, and privileged access, then cut access back to what they really use.

Unmanaged data stores let permissions drift while sensitive data accumulates unnoticed. They are repositories an organization doesn’t actively govern, leaving them without an owner, an access-review cadence, or a retention policy. Securing them means assigning ownership, correcting access, and maintaining continuous governance and visibility.

Most organizations have a removable media policy. Few enforce one, and that shortfall drives breach costs and compliance exposure. Closing it takes a default-deny baseline, an approved-device register, encryption on everything you allow, expiring exceptions, and audit evidence proving each clause works. Writing a removable media policy takes an afternoon, and most organizations already have one covering USB drives and other portable storage.

AI agents are non-human identities. They hold credentials, carry permissions, and act on systems around the clock, usually with standing access nobody reviews. The Salesloft Drift breach reached more than 700 organizations through exactly that kind of over-scoped, non-expiring token, with no prompt injection involved. The controls already exist: inventory every agent, scope it to least privilege, expire its access, review it on a schedule, and detect when it's abused.

Insider risk is often framed as an external attacker problem, but a real blind spot sits closer to home: who inside your own security stack can open sensitive files they never needed to see. Classification tools that require broad scanning access often hand that same access to every admin who configures them, turning the tool meant to reduce exposure into another path to it. The people with the least oversight, your own admins, can end up with the most unchecked visibility into regulated data.

Our 2026 Identity and Data Security Report put compromised identity ahead of misconfigured permissions as the leading route to unauthorized access, 41.8% against 33.9%. If identity is the way in, the controls around identity belong together, and that's the reasoning behind most of the consolidation we've seen over the past few years. But how is the work split up?

Operations require elevated access and organizations grant it on trust, so privileged user monitoring has to turn that trust into evidence. An authorization record shows only that the system permitted an action. Monitoring produces a reviewable account of which elevated rights each person used and when, which lets an auditor or investigator test activity without disrupting administration.

Separation of duties, also called segregation of duties, is a control that splits a sensitive business process across more than one person so no single user can both execute and approve the same action. Organizations enforce it by mapping conflicting duties into a matrix, applying role-based access control and least privilege, requiring independent approval on high-risk transactions, and reviewing access on a set cadence.

Most AD cleanup processes stop at the domain boundary, but hybrid audits don’t. Here’s what auditors actually check across Active Directory and Entra ID, and the gaps that trip up teams in their first review. Ask a few IT teams how they handle offboarding and you’ll hear the same answer: disable the account in Active Directory, close the ticket, and move on.

Here's a test you can run in about five minutes. Pull up a privileged account in your directory, one that was used in a session yesterday. Is the account still there? Does it still hold the same privileged group memberships it had yesterday? I'd bet good money the answer to both is yes. That's not a criticism of your PAM tool. It's what traditional credential rotation was built to do, and more importantly, what it was never designed to do.

HIPAA compliance requires healthcare providers and their business associates to safeguard protected health information (PHI) through privacy and security rules, risk assessments, and breach notifications. Covered entities must implement administrative, technical, and physical safeguards, including access controls, encryption, auditing, and workforce training. Noncompliance can result in steep fines and reputational damage, making strong data governance and adherence to NIST-aligned safeguards essential.