Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

As AI becomes embedded in insider risk platforms, organizations are evaluating more than detection capabilities. Governance, data privacy, model control, and transparency are now central to the assessment of AI-enabled IRM solutions.

Single Sign-On (SSO) means fewer password headaches, faster access, and better security for human users. But the same cannot be said for AI agents. SSO, a core part of Identity and Access Management (IAM), which was initially built for humans, can no longer be used for AI agents. For humans, it was quite simple - just log in once, and authenticate across connected apps. However, when an AI agent tries to authenticate the same way, the traditional access model breaks fast.

Clinicians are pasting patient summaries into ChatGPT to draft discharge instructions. Billing staff are uploading claim data to AI writing tools to speed up appeals letters. Nurses are using consumer AI assistants to look up drug interactions between patient visits. None of this was approved by the security team, and most of it would surprise the compliance officer.

Every week, someone in your organization stands up an AI service. Maybe they told security about it, but probably not. By the time it shows up in your inventory, it has been running for weeks, processing data, calling external APIs, and doing things nobody formally reviewed.

There’s a conversation happening in boardrooms, security operations centers, and developer standups that I find both thrilling and concerning: the conversation about AI-assisted development. Engineering teams are shipping features in hours that once took months. Products that would have required six-month roadmaps are being prototyped in a weekend.

AI is reshaping the modern workplace. From automating tasks to generating in-depth research in seconds, AI tools are enhancing productivity at a lightning pace. GenAI assistants, agentic browsers, and automation platforms are everyday tools that employees are interweaving into their daily workflows. However, with this powerful new capability comes the serious risk of data loss.

For much of security history, one metric dominated: recall. Recall means: of all the sensitive data that exists, how much did you catch? If there are 100 pieces of PII in a document and your system finds 95, your recall is 95 percent. This made sense in the old security world. If a firewall missed a real threat, the company had a serious problem. If it blocked something safe, someone could investigate and fix it.