Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Netwrix's 2026 research found a 4x gap in breach rates between organizations where AI has significantly grown their identity count and those where it hasn't. Static credentials are AI’s easiest way in: passwords, keys, and tokens that never expire and never get checked. AI didn't invent the over-privileged credential, it just found the fastest way to use one.

A Reddit thread on r/activedirectory asking whether Active Directory is going away pulled in loads of comments, and the most upvoted answer compared AD to COBOL: still running, still critical, still not going anywhere. That comparison holds up when you check whether COBOL is still used today, since it runs core banking and government systems decades after its supposed retirement. The real risk for most IT teams isn't AD disappearing.

Most AI deployment policies stop at approved chat interfaces. Meanwhile, employees install browser copilots, AI extensions, and third-party plugins that never touch Microsoft's management stack. IT can't configure what it can't see, and Group Policy and Intune only govern Microsoft's world. This post covers what actually happens once AI tools show up outside policy, five things most teams miss, and how PolicyPak enforces controls directly on the apps and browser extensions themselves.

“A man’s worth is no greater than the worth of his ambitions.” Marcus Aurelius wrote that almost two thousand years ago, in a private journal he never intended anyone to read. Coming from a man who held every title Rome could give, it’s a telling way to measure worth: not by what you hold, but by what you aim at. It has stuck with me, because everything I’ve seen in my career backs it up. Deep technical knowledge is where great engineering starts.

Say a sales rep uses an AI assistant to help manage their pipeline. The rep has role-based access to Salesforce, scoped to their territory and their accounts. The assistant, wired in through an API integration, often doesn't have that same scoping. It authenticates as a service account with broad read and write access across the org, because that was faster to set up than a permission model that matches what the actual user is allowed to see.

Unknown block type "undefined", specify a component for it in the `components.types` option AI is creating urgency at the board level and a definitional problem in the market.

Access review tools differ more than their marketing suggests: standalone certification platforms, full identity governance suites, and compliance automation tools all call themselves access review solutions and solve different problems at different costs and with varying implementation overhead. Matching governance maturity and compliance framework to the right category matters more than comparing feature lists, especially when audit evidence must prove that rejected access was actually removed.

Most teams conflate two questions that require separate tools: who can access a sensitive share right now, and who changed access or opened files. Native Windows utilities resolve neither at scale, so audits stall and incidents lose their trail. The tool you need calculates effective access across nested groups and captures every permission change with attribution across Windows, network-attached storage, and SharePoint.

AI hacking tools are compressing the time between finding a target and logging in as them. Password spraying, already responsible for the vast majority of identity attacks, is the technique benefiting most. Attackers use AI hacking methods to optimize timing, rotate infrastructure, and personalize lures at a scale no human operator could match manually.

Unknown block type "undefined", specify a component for it in the `components.types` option Every conversation about AI and early-career employees seems to start in the same place: will it weaken foundational skills by doing too much of the work? That's a reasonable concern. It's also not the question that ended up mattering most this summer.