What Is the AI Attack Surface? Securing AI Agents and the Software Supply Chain
Every third-party AI model your company embeds and every AI agent an employee spins up adds to what's now called the AI attack surface and most security teams can't fully see it. That gap sits at the center of "Secure New Frontiers," one of three themes in a 2H26 cybersecurity trends update from Gartner®, and it shows up in two places most organizations are already exposed: software supply chains that don't account for AI components, and identity systems that weren't built for machine and agent identities.
This post breaks down what's actually changing in both areas, why the old playbook doesn't cover it, and what closes the gap not after the incident, but before one happens.
What Does "Secure New Frontiers" Mean?
"Secure New Frontiers" is one of three themes Gartner uses to organize its top cybersecurity trends for the second half of 2026, alongside "Transform Governance" and "Normalize AI Adoption." Broadly, it covers parts of the environment that are new enough, or changing fast enough, that most existing controls weren't designed for them.
This post focuses on the two trends within that theme that are the most immediately actionable for most security teams right now: AI-augmented software supply chain risk, and identity and access management (IAM) for AI agents. Both trace back to the same root problem — assets and identities that exist in the environment but aren't consistently tracked, related to each other, or monitored as they change. Point-in-time audits and static asset lists, the traditional way most organizations have handled this, don't hold up against assets that update, drift, or spin themselves up without a ticket.
Get the full report This post covers two of the six trends in Gartner's "Top Trends in Cybersecurity — 2H26." Download the full report for the complete picture, including how CISO governance is shifting and how frontier AI is reshaping vulnerability management.
Why Are CISOs Expanding Software Supply Chain Security to Cover AI?
Software supply chain security used to mean tracking open-source dependencies and third-party libraries. That scope is no longer wide enough. Organizations are now embedding third-party AI models and AI-powered commercial software directly into production systems, often without the same vetting their traditional software goes through and the traditional software supply chain security (SSCS) playbook doesn't extend to AI components by default.
59% of CISOs rank third-party and supply chain attacks among their top five threats to prioritize over the next 12 months, according to Gartner's 2026 CISO Role Survey. That urgency tracks with what's actually happening inside organizations: business pressure to ship AI features fast is pushing teams to adopt open-weight and frontier models, plus the third-party components that embed or call them, without a consistent process for verifying their security posture first.
What is AIBOM, and why does it matter here?
An AI Bill of Materials (AIBOM) is a structured inventory of the models, datasets, weights, and third-party components that make up an AI system — the AI-era counterpart to a traditional software bill of materials (SBOM). Without one, a security team has no reliable way to answer basic questions like "which of our applications call this model" or "did a vulnerability in this open-weight model just become our problem."
An AIBOM answers the "what's in it" question. It doesn't, on its own, answer the harder one: what does this model actually touch once it's deployed? That's a question about relationships — which production systems call it, which identities have access to it, and what data it can reach — not just a list of components. Getting from an inventory to that answer is where most software supply chain programs stall, because the AIBOM and the asset inventory usually live in two different tools that don't share context.
What to do about it:
- Get visibility into the supply chain risk that commercial software, AI models, and AI agents introduce, and continuously validate it through AIBOM and binary composition analysis, not a one-time review.
- Extend third-party cyber-risk assessments to explicitly cover AI-specific software and its components, in partnership with legal and procurement.
- Connect AIBOM and SBOM data to your broader asset inventory so that when a specific model or library is flagged, you can immediately see which production systems, identities, and data it's connected to — instead of chasing the answer manually across separate tools.
- Build incident response playbooks specifically for AI supply chain disruptions, including how to isolate a compromised model or agent without taking down the systems that depend on it.
How Is IAM Adapting to Secure and Enable AI Agents?
Identity and access management (IAM) was built around a fairly stable assumption: identities belong to people, and people don't change roles every few minutes. AI agents break that assumption. They're created, granted access, and retired at a pace and volume that legacy IAM — built on static roles and long-lived secrets — was never designed to handle.
94% of organizations report an increase in machine identity volume over the past 12 months, driven primarily by AI and machine learning adoption (52%) and autonomous agents (35%), per Gartner's 2025 Machine Identity Management survey. That growth has a real cost: 58% of organizations have experienced at least one cybersecurity incident involving a compromised AI-linked machine identity, with consequences ranging from operational disruption to direct financial loss.
Why can't legacy IAM handle AI agents?
Legacy IAM tools were designed for human identities authenticated with static, long-lived credentials and broad role assignments. AI agents need something closer to just-in-time, fine-grained authorization tied to a specific task — plus a documented business purpose and a human owner for every agent, which most organizations don't currently track.
The harder operational question isn't just registering agent identities — it's knowing what each one can actually reach. An agent identity with no documented owner is a governance problem. An agent identity with no documented owner and standing access to a system holding sensitive data is a security incident waiting for a trigger. Answering "which of our AI agents can reach which systems, and are any of those systems missing required controls" requires identities and assets to be modeled as connected, not tracked in parallel spreadsheets.
What to do about it:
- Assign a documented business purpose and an accountable human owner to every AI agent at the point of identity registration — not after the fact.
- Automate credential lifecycle management so provisioning and deprovisioning can keep pace with how fast agents are actually created and retired.
- Prohibit sharing human credentials with AI agents, and issue every agent its own unique identity.
- Build fine-grained, policy-driven authorization tailored to nonhuman actors, rather than reusing human role templates.
- Map each agent identity to the specific systems, data, and permissions it holds, so a compromised or over-privileged agent shows up as a visible coverage gap instead of an unknown.
Why Asset Visibility Is the Common Thread Behind Both Trends
Software supply chain risk and machine identity risk look like two different problems, but they break down the same way: an asset or identity exists in the environment, and the organization either does or doesn't have a current, queryable answer for what it's connected to. Knowing an AI agent or a third-party model exists is a start. Knowing what it's connected to, what data it can reach, and what the blast radius would be if it were compromised is what actually changes how a security team responds.
That's the practical argument for treating asset relationships — not just asset lists — as the foundation for both trends. JupiterOne's Cyber Asset Attack Surface Management capability is built on a graph-native architecture, so software components, AI models, machine and agent identities, and the infrastructure they touch are represented as nodes with typed relationships in one continuously updated model, instead of separate tools for supply chain risk, IAM, and asset inventory that don't share context with each other.
In practice, that means a security team can ask a single question — which AI agents have access to which systems, and which of those systems are missing required controls — and get an answer in one J1QL query, instead of reconciling exports from three different sources. That's the difference between discovering a coverage gap during a tabletop exercise and discovering it during an incident.
Related: what's happening to vulnerability management Supply chain and identity aren't the only areas frontier AI is reshaping. Gartner's 2H26 report also found that AI-accelerated vulnerability discovery is breaking traditional, volume-driven patching, and that raw patch-speed metrics no longer reflect real risk reduction. JupiterOne's Kevin Tonkin and Chad Richts join VulnCheck's Pat Garrity for a fireside chat on what changed and what it actually takes for a security team to keep up.
The Clock Is Ticking Faster Than Your Scanner: A First Look at Emerging Exposures September 22, 2026 · 11:00 AM Central
FAQ: AI Attack Surface Basics for 2026
What is the AI attack surface? The AI attack surface is the combined set of AI models, AI agents, and the software components, data, and identities connected to them that an attacker could target. It includes third-party and open-weight models embedded in production systems, autonomous AI agents with access to internal tools and APIs, and the machine identities and credentials those agents use.
What is AIBOM (AI Bill of Materials)? An AIBOM is a structured inventory of the models, training data, weights, and third-party components that make up an AI system. It extends the concept of a software bill of materials (SBOM) to cover AI-specific components, giving security teams a way to track what's actually inside the AI systems they've deployed.
Why can't legacy IAM tools secure AI agents? Legacy IAM tools were built for human identities using static roles and long-lived credentials. AI agents are created and retired far more frequently, need fine-grained and often short-lived permissions tied to specific tasks, and require a documented owner and business purpose that most identity systems don't currently capture.
Is CAASM the same thing as software supply chain security? No. Cyber Asset Attack Surface Management (CAASM) is the broader discipline of discovering and maintaining visibility into all of an organization's assets and their relationships. Software supply chain security is narrower — it focuses specifically on the risk introduced by third-party code, models, and components. CAASM provides the asset and identity visibility that makes software supply chain risk, including AI-specific risk, possible to track in the first place.
How do you get visibility into both AI agents and AI supply chain risk without adding another disconnected tool? The two problems share the same underlying data: assets, identities, and the relationships between them. Rather than running separate tools for AIBOM tracking and machine identity governance, security teams are increasingly consolidating that data into a graph-native asset inventory, where a model, the agent that calls it, and the systems that agent can reach are all represented as connected nodes — queryable together instead of reconciled by hand.
Sources: Gartner, "Top Trends in Cybersecurity — 2H26," 19 August 2026, ID G00860263 (drawing on the 2026 Gartner CISO Role Survey and the 2025 Gartner Machine Identity Management in a Hybrid, Automated AI World Survey). Statistics are paraphrased and attributed to the underlying named surveys, not reproduced from the report itself.
GARTNER is a trademark of Gartner, Inc. and/or its affiliates.
