Tenable Research Reveals Growing AI Exposure Gap Fueled by Supply Chain Risks and Lack of Identity Controls
Tenable (NASDAQ: TENB) released its Cloud and AI Security Risk Report 2026, finding widespread AI-related exposures across cloud, supply chain and identity.
Sentiment and the balance of points
Rhea-AI Sentiment reads the wording of the document, how positive or negative its language is on a 1 to 5 scale. The balance of points shown with the takes weighs what the document actually discloses, so the two can disagree, for example when a trial that missed its main goal is described in upbeat language.
Rhea-AI Summary
Tenable (NASDAQ: TENB) released its Cloud and AI Security Risk Report 2026, finding widespread AI-related exposures across cloud, supply chain and identity. Key metrics: 86% host third-party packages with critical vulnerabilities, 70% use AI/MCP packages, and 65% expose unused cloud credentials.
The report warns of rising non-human identity risk, recommends least-privilege controls, secret rotation, unified visibility across code, VMs, identities and cloud to reduce an accelerating AI exposure gap.
Positive
- 86% of organizations identified hosting third-party code with critical CVEs
- 70% have integrated at least one AI or MCP third-party package
- 65% of organizations identified ghost cloud credentials, enabling targeted remediation focus
Negative
- 18% granted AI services administrative permissions that are rarely audited
- 52% of risk now resides in non-human identities versus 37% in human users
- 13% deployed packages with a known history of compromise
Details
News Market Reaction – TENB
On Feb 19, the day this news came out, TENB closed 0.77% below the previous close.
Data tracked by StockTitan Argus for the Feb 19 session.
Key Figures
- Critical-vuln third-party code
- 86%
- Organizations hosting third-party packages with critical-severity vulnerabilities
- Forgotten cloud credentials
- 65%
- Organizations exposing assets via "ghost" cloud secrets
- AI/MCP package adoption
- 70%
- Organizations integrating at least one AI or MCP third-party package
- History-of-compromise packages
- 13%
- Organizations deploying third-party packages with known past compromise
- Admin AI permissions
- 18%
- Organizations granting AI services administrative permissions
- Non-human identity risk
- 52%
- Risk share attributed to non-human identities like AI agents
- Human user risk
- 37%
- Risk share attributed to human users
- Dormant high-risk identities
- 49%
- Identities with critical excessive permissions that are dormant
Previous AI Reports
-
Gartner named Tenable the company to beat for AI exposure assessment.
-
General availability of Tenable One AI Exposure for unified AI risk management.
-
Launch of Tenable AI Exposure to manage enterprise generative AI risks.
-
AI-powered VPR enhancements to narrow high-risk vulnerabilities to 1.6%.
-
AI security awards and Apex Security acquisition to bolster AI capabilities.
24h Move is the share-price change in the day after each event; other market factors may also have contributed.
Key Terms
Model Context Protocol (MCP) technical
CVEs technical
Exposure Management technical
AI-generated analysis. How Rhea-AI works. Not financial advice.
Report finds
COLUMBIA, Md., Feb. 19, 2026 (GLOBE NEWSWIRE) -- Tenable® (NASDAQ: TENB), the exposure management company, today released its Cloud and AI Security Risk Report 2026. The research reveals organizations face a zero‑margin AI exposure gap as they inherit cyber risks faster than they can address them. Engineering velocity — driven by AI adoption, third-party code and cloud scale — has outpaced the human-led ability to assess, prioritize and remediate risks before threat actors exploit them.
The AI Exposure Gap is a largely invisible form of exposure that emerges across applications, infrastructure, identities, agents and data, and that most security teams are not equipped to manage. Tenable’s analysis of cloud environments identifies severe risks across four key security areas: AI security posture, supply chain attack vectors, least privilege implementation and cloud workload exposure — all of which demand immediate attention. The report includes actionable guidance for security and business leaders to reduce risk across cloud and AI environments.
Key findings from the Cloud and AI Security Risk Report 2026 include:
70% have integrated at least one AI or Model Context Protocol (MCP) third-party package, embedding AI deep into applications and infrastructure, often without central security oversight.86% host third-party code packages with critical-severity vulnerabilities, making the software supply chain a primary and persistent source of cloud exposure. Furthermore, nearly 1 in 8 (13% ) have deployed packages with a known history of compromise, such as the s1ngularity or Shai-Hulud worms.18% of organizations have granted AI services administrative permissions that are rarely audited, creating a "pre-packaged" catalog of privileges for attackers to claim.- Non‑human identities such as AI agents and service accounts now represent higher risk (
52% ) than human users (37% ), forming “toxic combinations” of permissions and access that fragmented tools fail to connect. 65% possess "ghost" secrets—unused or unrotated cloud credentials—with17% of these tied specifically to critical administrative privileges.49% of identities with critical-severity excessive permissions are dormant.
“AI systems embedded in infrastructure pose a critical risk that CISOs and defenders must address, in addition to anticipating emerging threats from both AI and cloud technologies. Lack of visibility and governance means teams are at the mercy of new exposures, including over-privileged identities in the cloud,” said Liat Hayun, Senior Vice President of Product Management and Research at Tenable. “By focusing on the unified exposure path, organizations can stop managing ‘security debt’ and start managing actual business risk.”
To manage emerging risks, organizations must secure the AI integration process through comprehensive visibility and identity-centric controls. This includes enforcing least privilege for AI roles, neutralizing "ghost" identity risk and eliminating static secret exposure. Third-party code and external accounts are now extensions of organizations' infrastructure; steps to reduce extended supply chain exposure include unifying visibility across code packages, virtual machines, identity access and cloud environments.
The 2026 Cloud & AI Security Risk Report presents findings from the Tenable Research team, analyzing anonymized telemetry from diverse public cloud and enterprise environments collected from April to October 2025 (AI findings extended through December 2025).
Exposure Management is the practice of identifying, evaluating, and prioritizing the risks posed by all entry points an attacker could exploit. This includes not just software vulnerabilities (CVEs), but also misconfigurations, excessive user privileges (identity risk), cloud security gaps, and the "shadow" assets created by AI and third-party supply chains.
Download the report here.
Read today’s blog post here.
About Tenable
Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for over 40,000 customers around the globe. Learn more at tenable.com.
Media Contact:
Tenable
tenablepr@tenable.com
FAQ
AI-generated questions and answers. How Rhea-AI works. Not financial advice.