{
  "id": 16599893,
  "title": "IT and security leaders of the AI era must go back to basics and beware the hype",
  "url": "https://urgent.news/2026/10/26/it-and-security-leaders-of-the-ai-era-must-go-back-to-basics-and",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-26T11:31:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/it-and-security-leaders-of-the-ai-era-must-go-back-to-basics-and-beware-the-hype"
  },
  "original_language": "en",
  "account": "Information security leaders, including CISOs and CIOs, should not simply chase the latest hype surrounding AI, but also focus on the proven return on investment offered by identity security. The information security landscape is rapidly evolving due to agentic AI, which can potentially expose new attack surfaces. Despite some skepticism about the hype, the fact remains that information security leaders must rigorously examine the fundamentals of their discipline. Even in sophisticated and mature enterprises, breaches often result from the absence of essential controls, such as credentials and permissions that agents should not have access to. The term \"AI washing\" refers to the overstatement of AI's significance in products, projects, or strategies. To demystify data security and separate hype from reality, a higher value should be placed on specificity when discussing risks. The identity challenge lies in recognizing that the industry's focus on AI security is understandable but not actionable. Instead, a more precise approach is to concentrate on identity management. When individuals join an organization, they are granted privileges based on their roles, seniority, and needs. However, in times of rapid growth, maintaining proper identity management becomes increasingly challenging due to the constant influx of freelancers, consultants, suppliers, auditors, and temporary staff. This gap in access management is precisely what autonomous AI agents exploited in the Hugging Face breach earlier this year. The underlying vulnerability was not new, but the attack itself was. The Hugging Face breach exposed a critical issue – that nobody was responsible for managing non-human identities (NHIs) with extraordinary permissions and access. This incident underscores the need for CIOs, CISOs, HR, and chief risk officers to collaborate and establish clear guidelines for managing NHIs. The consequences of not addressing this issue are evident, as evidenced by Verizon's 2026 Data Breach Investigations Report, which found that vulnerabilities have become the top initial access vector for the first time in 19 years. However, it's crucial to remember that vulnerabilities only serve as entry points when identities are unmanaged. Had proper least-privilege, just-in-time access, and NHI governance been implemented, the Hugging Face breach would have been contained, even after the vulnerability was exploited. Ultimately, the solution lies in returning to the basics and learning from past mistakes, as history teaches us that those who ignore it are doomed to repeat it.",
  "summary": "AI is transforming security, but organizations must not lose sight of identity, access and least privilege.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}