The next insider threat is already inside: How generative AI quietly accumulates power across the organisation

Cyber security teams have spent years preparing for malicious insiders, compromised accounts, and careless employees. But a new insider is entering the enterprise through an unexpected door: generative AI embedded across office suites, ticketing systems, messaging platforms, code assistants, search tools, workflow automation, and internal knowledge environments. It does not need salary, sleep, ideology, or intent. It only needs access.

This talk argues that many organisations are quietly creating a new class of insider threat without naming it as such. As generative AI is embedded into more products and workflows, it begins to accumulate visibility across emails, documents, tickets, chat histories, code repositories, calendars, customer records, and operational tooling. Each individual integration looks harmless, useful, even productive. But once these permissions compound, generative AI is no longer acting like a simple assistant. It starts to behave like a non-human operator with broad contextual reach, weak judgement boundaries, and growing power to shape, recommend, or trigger actions that humans barely review.

The real danger is not only data leakage. It is the collision of three forces: permission creep, authority laundering, and misplaced trust. Permission creep arises when generative AI inherits far more context and capability than any single employee would normally hold. Authority laundering occurs when weak or risky actions become socially acceptable because they arrive as "AI recommendations," "workflow outputs," or "drafted by the system." Misplaced trust emerges when staff treat fluent language as evidence of sound judgement, and when repeated exposure normalises unsafe delegation.

Rather than stopping at alarm, this session proposes a different solution direction: organisations need a security architecture for non-human operators. Today, most controls assume either a human user or a passive software tool. Embedded generative AI is neither. It should be governed as a semi-autonomous enterprise actor with its own bounded identity, memory scope, action surface, trust tier, and liability envelope. That means moving beyond ordinary access control toward non-human identity, non-human segregation of duties, non-human approval thresholds, and non-human audit semantics.

I will present a practical model for this shift: per-agent identity isolation, constrained memory domains, action-class licensing, cross-tool delegation limits, mandatory provenance tagging, and a strict separation between recommendation authority and execution authority. The central question is no longer whether the model answered correctly, but whether this non-human actor should have been allowed to see, infer, recommend, remember, or act at all.

The blunt message is simple: the next insider threat (Generative AI) will not always steal credentials or exfiltrate files. Sometimes it will be invited in by procurement, integrated by IT, trusted by staff, and praised for productivity right up to the moment it quietly becomes part of the attack surface.