An AI agent reviews documents, queries an application via an API, and then triggers an operation in the cloud. This scenario encapsulates the major challenge of 2026. Components that are each secured on their own can, in fact, create a pathway for an attack once they are combined. Existing models remain useful, provided they account for these relationships across team boundaries. 

The attack slips through the layers 

A compromised account can open multiple applications, and an exposed technical secret can grant access to an API. Furthermore, a failure in the identity service can render tools unavailable even if they are otherwise intact. Security must therefore cover the delegation of permissions, connectors, and shared dependencies. 

Especially since, with generative AI, the processed content can become a vector for attack. Malicious instructions in a document can divert an LLM from its original task. If it is controlling an agent with extensive privileges, this manipulation can lead to a data breach or an undesirable action. OWASP specifically identifies this risk of autonomy, excessive functionality, and excessive permissions. 

API abuses, meanwhile, serve as a reminder that authenticated access does not necessarily grant permission to do everything. An application can, in fact, correctly identify the caller while still allowing them to view data they should not have access to. Controls must therefore be applied to each resource and each operation. 

However, a siloed defense system may fail to detect this type of sequence of events. While a cloud access request, a document view, and an API call may seem routine, their sequence, on the other hand, may indicate an attack. Teams must therefore be able to correlate their observations. 

Identity becomes central, though it is not enough on its own 

Who is acting, on whose behalf, with what permissions, and on what data? This question affects everyone today—employees, service accounts, applications, and AI agents alike. Every non-human identity must now have a designated responsible party, limited permissions, and revocable access. An agent tasked with reading invoices, for example, has no reason to be able to modify a supplier’s bank account information. 

Zero Trust, in fact, provides a framework for this discipline. It involves not granting implicit trust to a user or device simply because it is present on the network. Access must be justified based on identity, the requested resource, and context. Authentication does not grant carte blanche. 

This approach links access, data, applications, segmentation, and monitoring. And for AI agents—the major IT development of 2026—authorizations must be enforced by the systems that execute the actions. A model may thus propose an operation, but it must not decide on its own that it has the right to carry it out. Sensitive actions require validations commensurate with their impact. 

The challenge now is to make these controls manageable. The priority, therefore, is to harmonize policies, automate the access lifecycle, and collaboratively analyze available logs. Note, however, that single sign-on and risk-based controls can reduce unnecessary requests. Adding a tool is justified if it fills an identified gap, but an additional dashboard does not compensate for unclear accountability. 

As for consolidating everything onto a single platform, this can create a single point of failure. Backup access and crisis procedures must, of course, continue to function even if that platform becomes unavailable. 

NIS2 Ensures Business Continuity at the Executive Level 

NIS2 gives this development organizational significance. For the entities concerned, the directive requires that management bodies approve cybersecurity risk management measures, oversee their implementation, and be held accountable for any failures to meet these obligations. It covers, in particular, incident management, business continuity, backups, disaster recovery, and supply chain security. 

Which services should be maintained? What level of service degradation is acceptable? Who has the authority to suspend an agent or interrupt a data stream? These decisions involve business units, procurement, the IT department, and management before an incident occurs. 

They must also be tested. This is because simply restoring a backup does not, in and of itself, prove that operations can resume. In fact, it is necessary to verify data integrity, the availability of dependencies, and the teams’ ability to operate in a degraded mode. The exercises must measure the time required to understand the incident, contain its spread, and restore a reliable service. 

Ultimately, cyber resilience never eliminates the need to prevent security breaches. It adds another requirement: maintaining visibility, control, and the ability to take action when a line of defense fails. Anticipate, resist, recover, and adapt—that is precisely the framework established by NIST.