Rising Complexity, Not Just Threat Volume, Is Driving Cyber Risk
According to industry research, 70% of enterprises report increased cyber and IT risk over the past two years, driven less by attack volume and more by system complexity, automation, and the rise of AI-driven workflows.
In this episode of AppDevANGLE, I spoke with Bryan Sacks, Field CISO at Myriad360, about how AI, non-human identities, and expanding regulatory pressure are fundamentally reshaping enterprise security models.
The conversation highlights a critical shift: security is no longer just about defending systems; it’s about governing increasingly autonomous, interconnected environments where humans are no longer the primary actors.
Generalists Rise as Systems Become More Interconnected
One of the more visible changes in enterprise IT and security teams is the shift toward generalists. This isn’t a strategic preference, but rather, it is a structural necessity.
“It’s not really companies suddenly loving generalists… systems are more connected, more automated, and people are naturally ending up owning a lot more than they used to,” said Bryan.
As systems become more integrated, traditional domain boundaries break down. Roles that once focused on a single area, such as identity, email security, or vulnerability management, now span multiple domains.
At the same time, AI is lowering the barrier to entry for complex tasks. “A lot of the work that used to be specialized maybe isn’t that hard to replicate anymore… a generalist can actually knock a lot of that out with Gen AI,” Sacks explained.
This is fundamentally changing how organizations think about talent, ownership, and operational responsibility across both IT and security.
Shift Left Expands Beyond Developers Into the Business
The concept of “shift left” has evolved well beyond its original meaning of moving security earlier in the development lifecycle. “Shift left used to be about putting security earlier in the pipeline… now it’s more like a movement—how can I pass work to automation or to someone closer to the process,” said Sacks.
AI and agentic workflows are enabling non-developers (e.g., IT operators, business users, and analysts) to build automations and even applications. This creates a new class of “builders” across the enterprise and introduces clear advantages in speed and proximity to business processes. But it also introduces new risks:
- Outputs from agentic systems are less predictable than traditional automation
- Data flows become harder to track and govern
- New attack vectors such as prompt injection and data poisoning emerge
“People don’t always know where the data is flowing, how it’s stored, or how it’s being reused,” Sacks noted. This expansion of development beyond engineering teams is forcing organizations to rethink training, guardrails, and governance models at scale.
Non-Human Identity Emerges as the Largest Security Blind Spot
Perhaps the most significant shift discussed is the rapid growth of non-human identities like service accounts, APIs, and AI agents acting autonomously across systems. “You might have 10 to 20 non-human identities for every human… I’ve heard as much as 50-plus per human identity,” said Sacks.
This explosion creates a visibility and control problem that most existing identity systems were not designed to handle. “Almost all identity tooling in the past has been built based off of a human using it,” Sacks explained.
Unlike human behavior, which can be monitored for anomalies like unusual login times or locations, machine identities operate continuously and quietly. “Attackers don’t break in anymore—they log in,” Sacks emphasized.
This shift makes breaches harder to detect and increases the importance of identity governance as a foundational security layer, not just an access control mechanism.
Data Lakes Become the Foundation for Modern Security Operations
As environments grow more complex, traditional security models based on limited log ingestion and correlation are no longer sufficient. “Data lakes are really foundational now to observability… having the right data in the first place is everything,” said Sacks.
The difference is not just scale; it’s context. In traditional SIEM models, organizations detect events. In data lake-driven architectures, they can reconstruct behavior over time.
“It’s like having a security camera recording footage versus just a smoke detector,” Sacks explained.
This shift enables:
- Behavioral baselining across identities and systems
- Historical analysis of attack patterns
- Better understanding of blast radius and downstream impact
However, it also reinforces the need for unified visibility, as tool sprawl continues to create fragmented security postures.
Regulatory Pressure Pushes Cybersecurity to the Boardroom
Security is no longer just a technical function; it is now a governance and accountability issue at the executive level. “It’s not just a CISO problem anymore… board members are expected to assess cyber risk and demonstrate how they’re governing it,” said Sacks.
Emerging regulations are introducing personal accountability for executives, fundamentally changing how cybersecurity is discussed and prioritized. This shift requires organizations to translate technical risk into business impact. “Can you translate cyber risk into business terms—not just tools, but actual impact? That’s what matters,” Sacks added.
As a result, security leaders must now operate as business risk advisors, not just technical operators.
Analyst Take
Enterprise security is entering a new phase defined by automation, scale, and autonomy. The traditional model is built around human users, static systems, and well-defined perimeters, but it is breaking down under the weight of AI-driven workflows and machine-to-machine interactions.
Three structural shifts are driving this transformation:
- Identity is no longer human-centric: non-human identities now dominate access patterns
- Development is no longer centralized: AI enables distributed application and workflow creation
- Security is no longer reactive: it must operate continuously across dynamic, data-driven environments
What emerges is a new security model:
- Security becomes identity-first, not perimeter-first
- Governance becomes continuous, not periodic
- Observability becomes behavioral, not event-driven
The most important takeaway is this: The future of security is not about stopping attacks; it’s about managing autonomous systems at scale. Organizations that fail to evolve their identity models, data architectures, and governance frameworks will struggle to maintain control. Those that embrace this shift will be positioned to secure increasingly complex, AI-driven enterprises.
