Another outstanding Black Hat conference in the books, and as shocking as this might be to some, one of the major topics of conversation was…wait for it…AI. Yes, vendors and practitioners alike were talking about all things AI. But there were also some fundamental shifts in how we are now talking about identity and data security, and if you weren't paying attention to non-human identities, agentic data security, and AI token economics before this conference, hopefully you are now.
Let's start with the number that should keep every CISO up at night: non-human identities — service accounts, API keys, OAuth clients, workload identities, and now AI agents — outnumber human employees in nearly every organization, and in DevOps-heavy environments that ratio can run as high as 100:1. The problem isn't that we don't know these identities exist anymore; it's that we've been terrible at actually governing them. Vendor after vendor on the show floor made the same pivot: away from discovery-only dashboards and toward active governance of the privilege these identities hold. A handful of platforms went further, framing the goal as a single continuous loop that governs human, non-human, and agentic identities together rather than as three separate problems. The takeaway for practitioners: discovery was table stakes two years ago. In 2026, the bar is lifecycle enforcement — provisioning, scoping, rotation, and kill switches — because a dormant service account with standing privilege is now just as exploitable as a phished employee, except nobody's watching it.
Data security seems to continue to be an afterthought for those implementing agentic AI solutions within their environments. The consensus across the show was unusually consistent: a patchwork of application-layer fixes and legacy monitoring tools isn't enough anymore, because agents connecting to internal tools via protocols like MCP need security built into the data and control planes themselves, not bolted on afterward. Several new offerings focused specifically on catching prompt injection and stopping data exfiltration from coding agents and AI assistants, routing agent traffic through sanitization layers that strip hidden instructions before the agent ever acts on them. Others attacked the same problem from the visibility angle, aiming to give security teams a centralized view of where sensitive data actually goes once it starts moving across AI models, APIs, and third-party services. The common thread: data classification and DLP aren't optional add-ons to your AI strategy anymore. They're the foundation, because an overprivileged agent with database access is a faster, more thorough insider threat than any human could ever be.
I recently wrote a paper on AI token sprawl, and it was well received. And I was glad (maybe glad isn’t quite the right word) to see how much it was being discussed, mainly because AI token consumption isn't just a finance problem anymore and it's showing up squarely in security tooling. Multiple new observability offerings promised visibility into model usage, token consumption, spend, and sensitive data exposure, all pulled from telemetry security teams already collect. Others tackled ballooning SIEM and telemetry costs head-on, a problem multiplied by the sheer volume of data AI agents now generate and process. And research presented on agent harness design made a point worth remembering: the model you choose is only half the equation — the surrounding harness architecture can swing both benchmark performance and token cost dramatically, even with the same underlying model. In other words, efficient AI isn't just cheaper AI; poorly architected agent workflows are a governance and cost risk simultaneously.
Put it all together, and Black Hat 2026 made one thing clear: identity, data, and cost governance for AI agents aren't three separate initiatives anymore. They're the same problem, and it's time to treat it that way.