As we navigate the technological landscape of 2026, the traditional boundaries of corporate software are effectively dissolving. Matilda Bailey, a seasoned networking specialist with a deep focus on next-generation wireless and cellular solutions, joins us to discuss how the integration of artificial intelligence is fundamentally rewriting the rules of SaaS security. Her insights bridge the gap between legacy connectivity and the era of autonomous agents, offering a critical perspective for modern security leaders who are finding that their existing toolsets are no longer enough to manage the speed of AI.
We explore how SaaS platforms have evolved into dynamic execution environments where AI agents now act on behalf of users, often inheriting excessive privileges that create massive security gaps. The discussion covers the multiplication of nonhuman identities, the emergence of “shadow AI” hidden within sanctioned applications, and the strategic shift toward observability and unified governance required to mitigate risks that now move at machine speed.
When a sanctioned SaaS vendor introduces generative AI features through a routine update, how should security teams respond to keep their environment safe?
The old distinction between an “approved SaaS” and “approved AI” has effectively vanished, which creates a significant blind spot for many organizations today. When a vendor quietly slips agentic capabilities into a tool your team has been using for years, they are essentially introducing a new execution environment that can query business systems, create tickets, or modify records without traditional oversight. Security teams must treat these updates as high-risk events, immediately expanding their discovery processes to inventory embedded model connections and OAuth integrations. It is no longer enough to trust an initial vendor assessment from several months ago; you need a continuous monitoring strategy that flags when an application suddenly gains the ability to process thousands of records autonomously. The goal is to ensure that these new features don’t bypass the visibility controls you’ve worked so hard to establish for the rest of your stack.
The rise of AI agents seems to be creating a surge in nonhuman identities—how does this complicate the current identity and access management landscape?
We are currently seeing a massive explosion in service accounts, API tokens, and machine identities that are often long-lived and poorly documented. These AI agents act as intermediaries, but because they are frequently granted broad permissions to ensure “smooth” performance, they become a prime target for exploitation. In an environment with hundreds or even thousands of SaaS applications, these nonhuman identities often have privileges that far exceed their actual operational needs, creating a sprawling web of access that is difficult to inventory. Security leaders need to pivot toward managing these “ghost” identities with the same rigor as human administrator accounts, ensuring that every token and key has a defined owner and a strictly limited lifespan. If an agent is poorly inventoried, it becomes a silent gateway for attackers to move laterally across your connected systems.
Why is the concept of ‘least privilege’ so much harder to enforce when AI agents are inheriting user permissions?
The convenience of allowing an AI assistant to inherit a human user’s permissions is a dangerous trap that many organizations fall into during deployment because it’s the easiest way to get the tool running. While it feels seamless for the user, it creates a massive “blast radius” where a simple prompt injection or a compromised agent can lead to automated, high-speed misuse of sensitive data. For example, an identity that once allowed a person to view a single CRM record might now be inherited by an agent capable of processing thousands of records across several connected applications in seconds. We must implement granular controls that require explicit approval for high-impact actions, ensuring that the speed of AI doesn’t outpace our ability to authorize its specific behaviors. An agent that summarizes a document should not automatically have the latent permission to delete it or share it externally.
How does ‘Shadow AI’ differ from traditional shadow IT, and what specific risks does it bring to the enterprise?
Shadow AI is far more insidious because it often lives inside the applications you have already vetted and approved. It’s not just about employees pasting sensitive data into consumer-grade AI services, although that remains a headache; it’s about the silent activation of AI plugins and model integrations within sanctioned tools without a formal security review. This creates a supply chain risk where models, agent skills, and third-party data sources become dependencies that traditional vendor assessments simply don’t cover. This expansion of the AI supply chain means that a vulnerability in an open-source component or a Model Context Protocol server can suddenly compromise your entire SaaS ecosystem. Security teams have to look past the brand name of the SaaS vendor and start scrutinizing the underlying AI dependencies that are being pulled in through the backdoor.
As attackers use AI to accelerate reconnaissance and credential abuse, how can defenders leverage observability to stay ahead?
Defense in 2026 is about shrinking the time between initial access and meaningful abuse by making AI behavior completely transparent and predictable. This involves logging every single agent action, tool call, and identity use, then feeding those high-fidelity events directly into security operations for real-time analysis. We need to move beyond simple log collection and start testing these agents for excessive agency and data leakage through periodic stress-testing of their prompt responses. By making these autonomous actions observable, we can detect if an agent is being influenced by malicious content in an email or a website before it can trigger a wider breach. If you can’t see what your agents are doing in the background, you are essentially flying blind while your attackers are moving at machine speed.
What advice do you have for CISOs who feel overwhelmed by the speed at which AI is integrating into their SaaS stack?
My best advice is to stop trying to build a separate “AI security program” and instead integrate AI governance directly into your existing SaaS, identity, and data protection workflows. Every AI-enabled offering should have a clear owner, a specific data classification, and a defined level of acceptable autonomy that is proportional to the business risk. Your goal isn’t to stop people from using these tools—because they will use them anyway—but to make the sanctioned AI options easier and safer to use than the unsanctioned ones. Focus on the familiar principles of visibility and control, but apply them to systems that now have the power to act on their own. If you can master the management of nonhuman identities and enforce strict data boundaries, you can turn the complexity of AI into a secure and powerful advantage for your organization.
What is your forecast for SaaS security?
I predict that over the next few years, we will see a total convergence where SaaS security posture management and AI governance become a single, unified discipline. We will move away from chasing individual “shadow” apps and instead focus on building a robust fabric of data controls that follow information regardless of which agent, plugin, or API is processing it. Organizations that fail to address the over-permissioning of agents today will face significant automated breaches, while the leaders will be those who implement “human-in-the-loop” requirements for high-risk autonomous actions. Ultimately, SaaS security will no longer be about managing static software, but about governing a dynamic ecosystem of acting entities that operate at a scale and speed we are only just beginning to understand.
