Gartner’s How to Achieve the Minimum Viable AI Governance
Blog
For Continuous Risk Reduction, Start With 3 Cyber Problems
Config hardening
Operational Excellence
Ransomware
Risk Management
Most persistent cyber risk is not mysterious. It is familiar, deferred, and operationally difficult to eliminate. While detection tools highlight these vulnerabilities daily, achieving true continuous risk reduction requires shifting focus from passive monitoring to automated, safe posture control across identities, access points, and emerging software assets.
What keeps these known risks alive is not a lack of awareness, but the operational gap between detection and durable remediation. Unfortunately, that gap is getting more expensive.
Already last year, the global average cost per breach reached $4.44 million, with the U.S. average climbing to $10.22 million. And already last year, 16% of breaches involved attackers using AI. But it's not just the attacker side feeling the impact of AI. In 2025, one in five organizations reported a breach tied to shadow AI.
CrowdStrike’s 2026 Global Threat Report adds the pressure factor: the average eCrime breakout time dropped to 29 minutes. Just as meaningful is the fact that 82% of detections in 2025 were malware-free. That means that in the vast majority of cases, adversaries are making hay through valid credentials, trusted tools, and approved pathways instead of noisy malware.
That is the real backdrop for persistent risk. Attackers are moving faster, more quietly, and more comfortably through the same enterprise conditions defenders have been trying to clean up for years.
The Usual Suspects
So if you strip away the noise, which known risks still persist in virtually every environment?
From all we've seen over the years, three categories keep showing up because they sit at the intersection of high prevalence, high exploitability, and high operational friction:
- Overprivileged identities and identity drift
- Exposed remote control channels
- AI tool sprawl without governance
These are serious, extremely common, and difficult to excise exposures. Each one exploits a familiar weakness in how environments are run: too much trust, too many exceptions, and too little continuous enforcement.
1. Overprivileged identities and identity drift: the fastest ways to turn access into control
Most organizations have invested heavily in endpoint, email, cloud, and network defense. Yet the identity layer still decides whether an attacker stays contained or becomes systemic.
That is one reason this problem persists. Identity is no longer just an authentication problem. It is the control plane for the modern enterprise.
When permissions accumulate over time, nested group memberships create shadow admin paths, stale accounts remain active, service principals retain standing privilege, and temporary exceptions quietly become the permanent state.
The result is identity drift: access that no longer reflects the role, the workflow, or the business need.
This is exactly the kind of exposure attackers love. Sophos found that attackers used valid accounts in 56% of 2024 MDR and IR cases, and RDP was involved in 84% of cases, reinforcing how often compromise now starts with legitimate access rather than obvious exploit payloads.
The more interesting problem is not that excessive privileges exists; it's why they endure.
Most access review programs are periodic, human-heavy, and stale almost immediately. They are good at producing evidence for audits, but they are NOT good at keeping privilege aligned to constant organizational change. When teams add SaaS apps, cloud roles, contractors, AI agents, and machine identities faster than they remove them, drift becomes the default condition.
And AI is making the blast radius larger. IBM found that 97% of organizations reporting an AI-related breach lacked proper AI access controls and 63% lacked AI governance policies. When AI agents inherit the permissions, tokens, and trust relationships of the environments around them, that's a big problem. Over-privilege that was already dangerous with humans becomes even riskier when software can act at machine speed.
The novel perspective: identity drift is now an exposure multiplication problem
The usual framing says overprivileged identities are risky because attackers can escalate. True, but incomplete.
The more important point is that identity drift multiplies the impact of every other exposure in the environment. A cloud misconfiguration is worse when an identity can enumerate and pivot through it. A remote access exception is worse when the compromised account is over-scoped. A shadow AI tool is worse when its OAuth grant exceeds the operator’s actual business need.
In other words, identity drift is a force multiplier for the rest of the attack surface.
What to do instead
Eliminating standing privileges isn't a one-time project; achieving continuous risk reduction across active directory and cloud roles requires continuous posture checks that don't disrupt production workflows.
That means:
- Monitoring for privilege drift against a least-privilege baseline
- Finding stale accounts, orphaned grants, and unused standing privilege
- Validating service account and non-human identity scope continuously
- Tying remediation to dependency context so teams can remove privilege safely, not blindly
- Enforcing post-change validation so removed access stays removed
This is where safe remediation matters. If every identity change is treated as too risky to automate, drift wins by default.
The goal is not aggressive privilege revocation for its own sake, but business-smart remediation that removes unnecessary access without breaking what operators depend on.
2. Exposed remote control channels persist because they're useful
Security teams often describe exposed remote access as a misconfiguration. Sometimes it is. More often, it's a shortcut that outlived the emergency that created it.
A VPN had issues. A server needed urgent support. An MSP installed a remote monitoring tool. A team opened RDP “for tonight.” Six months later, the exception is still live, barely documented, and one credential away from becoming an intrusion path.
This is why remote control exposure keeps surviving even in mature environments. It's woven into operational habits.
The risk is not theoretical. Sophos found that external remote services were the most common access vector in ransomware cases, providingthe first foothold in 80% of attacks.
In 2026, the standard attacker playbook looks to find exposed access, authenticate with stolen or weak credentials, move laterally using legitimate tooling, and avoid noisy malware for as long as possible.
Indeed, remote control exposure is often a cultural problem more than a technical one. Most organizations can tell you their sanctioned remote access tools. Fewer can tell you every unofficial or forgotten remote control surface running across the fleet, especially after M&A, emergency support work, contractor onboarding, or shadow IT.
The novel perspective: the real exposure is exception drift
RDP, SSH, Quick Assist, TeamViewer, AnyDesk, ScreenConnect, and other RMM tools are not inherently the story. The story is exception drift.
Remote access becomes dangerous when the enterprise cannot distinguish between:
- Sanctioned versus forgotten access paths
- Temporary versus durable exceptions
- Operator activity versus attacker activity using the same toolset
That is why many organizations still get surprised by exposures they technically “knew” existed. They knew the category, but they failed to maintain the inventory.
What to do instead
As shadow AI and unexpected SaaS integrations expand your attack surface, static audits quickly fall short. Real continuous risk reduction demands real-time configuration assurance.
That means:
- Inventory every remote control surface
- Require strong authentication baselines, including MFA, NLA, and key-based access where appropriate
- Identify unauthorized RMM installations and remove them cleanly
- Watch for internet exposure continuously, not just during annual scans
- Detect when temporary exceptions persist beyond the intended window
- Re-check cached credentials and privilege artifacts after sensitive remote administration
This is another place where “push-button remediation” matters. Detection-only programs often flag exposed access quickly and then leave the fix sitting in a queue because nobody wants to break support workflows. That is how the exposure gap stays open.
3. AI tool sprawl persists because adoption is outrunning governance
AI risk is often discussed as if it were a future-state problem. It's not. It is already inheriting the same operational weaknesses that made earlier waves of SaaS and cloud adoption hard to govern.
The pattern is familiar. Teams adopt tools before controls catch up. Security is asked later to inventory, rationalize, and govern what is already in use. In the meantime, the environment absorbs new browser extensions, desktop assistants, code agents, plugins, OAuth grants, local memory stores, unmanaged prompts, and data movement paths that nobody has fully mapped.
IBM found that organizations with high levels of shadow AI saw breach costs that were $670,000 higher on average than those with low or no shadow AI.
CrowdStrike reported an 89% increase in attacks by AI-enabled adversaries in 2025 and documented legitimate GenAI tools being exploited at more than 90 organizations through malicious prompt injection and related tradecraft.
The lesson is not that AI created a brand-new category of cyber risk. It accelerated existing ones: excessive permissions, weak inventory, unmanaged software, insecure integrations, and blind trust in approved tools.
The novel perspective: AI risk is not primarily a model problem. It is an environment control problem
A lot of AI security discussion stays focused on model safety, jailbreaks, or abstract governance principles. Those matter. But in enterprise reality, some of the most material AI risk still sits lower in the stack.
Any effect governance must therefore be able to account for:
- The actual tools present on endpoints
- The plugins and connectors those tools invoke
- Token storage and related risks
- The data AI tools can reach
- The permissions agents inherit
- Configuration policy conformance over time
That is why AI governance cannot live only in policy documents or procurement workflows. It has to become part of continuous posture management.
What to do instead
You can't govern what you can't see, so start with inventory. Then move from visibility to continuous enforcement.
That means:
- Identifying AI tools, plugins, and agentic integrations on endpoints and in browsers
- Reviewing granted scopes, OAuth storage, local memory, sandbox settings, and plugin permissions
- Removing or containing unmanaged AI tools instead of merely documenting them
- Applying least privilege to AI agents and machine identities
- Monitoring for configuration drift as vendors release new capabilities and permission models
- Connecting AI governance to endpoint and application control so policy becomes enforceable, not aspirational
This is also where Remedio’s worldview is different from the usual “discover and warn” posture. Detection without safe remediation is a dead end.
The enterprise does not need more screenshots proving shadow AI exists. It needs a controlled way to harden what is approved, remove what is not, and sustain the posture after the first cleanup.
From Audit-Time Findings to Continuous Risk Reduction
All three of these exposure types survive for the same reason. They sit in the last mile between policy and operational reality.
- Identity policies say access should be least privilege, but roles drift.
- Remote access policies say exposure should be temporary and controlled, but exceptions persist.
- AI usage policies say tools should be approved and governed, but adoption outruns review.
That is why periodic audits do not solve the problem. They describe the environment at a point in time. They do not keep it inside a secure operating envelope.
And that is the broader lesson: persistent risk is not mainly a detection problem anymore. It is an enforcement problem.
Security leaders already have more tools than they can comfortably operationalize, with an average of 43 security tools in the enterprise. It's not in spite of that fact but partly because of it that 61% of security leaders have endured breaches due to failed or misconfigured controls.
With so many threats moving so fast around, operators cannot afford letting the complexity of their tooling become its own stumbling block.
As attack paths speed up, safe remediation has to speed up too. That means:
- Configuration integrity assurance across the stack (including but not limited to security tools)
- A simplified and streamlined path between detection & correction
- Continuous security monitoring and assessment
- Field policy validation
- Context-aware prioritization instead of severity-only ranking
- Instant rollback ability to support operational confidence
- Continuous enforcement and drift prevention
By moving beyond passive monitoring toward preemptive cybersecurity, enterprise security teams can finally realize true continuous risk reduction across their entire digital estate. And it is where device posture management becomes materially different from another dashboard.
The path forward is not another round of alerting. It is continuous visibility, continuous validation, and safe remediation that works at enterprise scale.
FAQ
Why do the same cybersecurity risks keep reappearing after they have already been identified?
Many enterprise risks persist because organizations detect them but struggle to remediate them safely at scale. Privileges accumulate, temporary remote access becomes permanent, and AI tools are adopted faster than governance can keep pace. Without continuous validation and enforcement, these risks naturally return as environments evolve.
What is identity drift, and why is it so dangerous?
Identity drift occurs when user, service, or machine account permissions gradually diverge from their intended role. Over time, users accumulate unnecessary privileges, stale accounts remain active, and temporary exceptions become permanent. This creates an expanding attack surface that enables privilege escalation and lateral movement without requiring software vulnerabilities.
Why are remote management tools still a security concern?
Remote administration tools such as RDP, SSH, VPNs, and remote management software are essential for IT operations, but they also provide attractive pathways for attackers. The risk is rarely the tool itself. It is the accumulation of forgotten access paths, excessive permissions, weak authentication, and temporary exceptions that were never removed.
How does AI adoption create persistent cyber risk?
AI introduces new software, browser extensions, local models, plugins, OAuth permissions, and agentic workflows that traditional asset inventories often miss. Without continuous governance, organizations lose visibility into what AI tools exist, what data they can access, and which permissions they inherit from users.
Why are periodic security audits no longer sufficient?
Traditional audits capture a point-in-time snapshot, while enterprise environments change continuously. New users, applications, cloud services, AI tools, and configuration changes can introduce risk within hours. Continuous assessment and automated remediation help keep security aligned with the current state of the environment rather than last quarter's assessment.
What is continuous risk reduction in cybersecurity?
Continuous risk reduction is an operational approach that combines continuous monitoring, configuration validation, safe remediation, and post-change verification. Instead of generating more alerts, it focuses on reducing the time that known risks remain exploitable while ensuring business operations are not disrupted.
How can organizations safely automate remediation without causing outages?
Safe remediation requires validating dependencies before changes are applied, testing the impact of configuration updates, supporting staged deployment, and providing rapid rollback if unexpected issues occur. Automation becomes practical when operational safety is built into the remediation process rather than treated as an afterthought.
What should security teams prioritize first to reduce persistent cyber risk?
Organizations should begin with the exposures that consistently enable compromise across most environments: excessive privileges, unmanaged remote access, and uncontrolled AI usage. Addressing these areas through continuous governance and safe remediation often delivers broader risk reduction than focusing exclusively on individual vulnerabilities.
About Author
