Insider threats remain one of the biggest security challenges facing businesses, with 90% of organisations experiencing at least one insider incident in the last twelve months. Yet the insider threats most businesses are preparing for are increasingly outdated: a disgruntled employee, a compromised account or someone making a costly mistake.

Those risks are still real, but the picture is now much broader – and harder to protect from. AI agents and other machine identities are increasingly being given authorised access to business systems and even taking actions on organisations’ behalf. In fact, machine identities now outnumber human identities by 109 to one.

As these tools become a part of everyday work, businesses need to think much more broadly about who – or what – counts as an insider threat. Keeping an organisation secure now means rethinking not just which people can access sensitive data, but which systems can too.

When the insider isn’t human

AI agents differ from conventional software because they can operate with some degree of autonomy, interpreting objectives and selecting actions without human oversight at every step. This does offerhuge productivity benefits, but it also means that a tool with excessive permissions can cause significant security problems extremely quickly.

Mark Molyneux, Field CTO at Commvault, explains: “Insider threats are spreading beyond the human domain and into the autonomous one. In a relatively short time, AI agents have evolved from productivity tools into systems with authorised access and greater decision-making capabilities. Recent incidents have shown the consequences, with agents bypassing controls designed to contain them in pursuit of their goals.”

“As the extent of what these tools can do becomes clearer, their permissions need to be controlled more tightly,” he adds. “Their access should be limited to what is specifically needed to carry out a task, with human approval required for anything that crosses that boundary, no matter how harmless it may seem.”

The challenge is also that AI agents remain vulnerable to the same human errors that have long been behind insider risk. These mistakes are amplified significantly when an AI is then able to act repeatedly at speed.

“Microsoft’s own AI research division exposed 38 terabytes of internal data through a single access token that was scoped to an entire storage account instead of the intended bucket, and set to full control instead of read only,” says Bertijn Eldering, associate sales engineer at HackerOne. “What came with it included workstation backups, service passwords, secret keys and more than 30,000 internal Teams messages. Agents are provisioned by the same people under the same delivery pressure, and they then act repeatedly and at machine speed.”

Getting access right

So how can organisations tackle this growing challenge? Neil Jenkins, Chief Product Officer at Fastmail, argues that managing and reducing access for every identity – not just the human ones – is key. “Strong authentication is a fundamental part of managing insider risk, but it’s only the first line of defence,” he says. “Businesses also need to apply the principle of least privilege, giving employees access only to what they need and making it easy to flag suspicious activity. Increasingly, that same thinking needs to apply to AI agents.”

“Like King Midas, an AI agent can give you exactly what you asked for, but not necessarily in the way you intended. Agents need tightly defined permissions, clear boundaries and appropriate monitoring so that an unexpected route to completing a task doesn’t become a security vulnerability.”

Eldering stresses the importance of traceability: “The more challenging issue is attribution. AI systems often arrive with their own logging, which can be less mature than the platforms around them. If you cannot separate an authorised automated workflow from a person misusing one, you have lost the signal that insider threat programmes depend on.”

“The answer to combating this challenge is practical. Give agents their own identities and scope them to a single task. Keep an audit trail you would be willing to defend in an investigation. Treat every change to a tool, model or integration as a change to your exposure, test that continuously rather than at review points, and keep a human in the loop for the judgement calls.”

Prepare for controls to fail

Identity controls, strict permissions and monitoring reduce exposure, but the truth is that no action can protect a business entirely. Recovery must therefore be seen as an integral part of insider threat management.

Commvault’s Molyneux advises: “AI is unpredictable by design so businesses should operate on the assumption that controls may fail and prepare accordingly to minimise downtime and reputational damage. With 90% of businesses saying they need identity management improvements to address AI-related risks, a ResOps model that brings identity, security and recovery together, whilst monitoring for unexpected activity, is essential.”

He continues: “Organisations should also maintain a recovery environment isolated from live systems, so that critical data and the backups required to restore it remain protected. Adopting this approach and preparing in advance allows businesses to respond quickly if an incident does occur.”

Isolation matters because a backup connected to the same environment can be altered or deleted by an insider, or an autonomous system with sufficient access. Keeping a known-good copy offline adds a physical barrier that network permissions alone cannot provide.

Carlos Sandoval Castro, IBM Worldwide Tape Offering Manager, the LTO Program, explains: “Tape storage is particularly well suited to this because data stored on offline tape is physically separated from connected infrastructure. Once a tape cartridge has been removed from the drive and securely stored, an insider – whether a compromised account, malicious employee or autonomous system – cannot remotely access, alter, or delete the data. Access requires someone to be physically present and able to retrieve and load the media.”

He adds: “This physical air gap can therefore provide an important additional layer of protection within a broader cyber resilience strategy. It helps organisations preserve a known-good copy of critical data that remains available for recovery even if production and connected backup environments have been compromised – a must-have when getting back to business-as-usual.”

Trust in an AI world

The rise of AI agents does not mean that traditional insider threats have disappeared. Employees, contractors and partners can still make mistakes, have their credentials compromised or deliberately misuse access. However, what’s different now is the number and type of identities within organisations, and the speed at which an error can spread.

A modern insider threat programme must therefore govern both people and machines together. Strong authentication, individual identities, least-privilege access, human approval for sensitive actions and reliable audit trails can reduce the likelihood of an incident. And isolated recovery copies and rehearsed response plans can limit the damage if those controls do fail.