Identity-first threat detection now spans human, NHI and AI identities

At a glance

What this is: This is Permiso Security’s account of its 2026 SC Award win and the case for identity-first threat detection across human, NHI, and AI identities.

Why it matters: It matters because IAM, PAM, and security teams need detection models that follow identity behaviour across every actor type, not just endpoints or networks.

👉 Read Permiso Security's SC Award profile on identity-first threat detection

Context

Identity-first threat detection starts from a simple premise: attackers usually move through identities, not just infrastructure. When a service account, API key, OAuth token, or AI agent is the real control point, traditional endpoint and network-centric detection often sees the attack too late.

For IAM and security teams, the issue is whether identity governance can keep up with cross-domain behaviour. If visibility stops at the human user or stops at the workload, the attacker can pivot into the blind spot and continue operating with valid access.

Key questions

Q: How should security teams detect attacks that move across human, NHI, and AI identities?

A: They should use a single identity model that links entitlements, relationships, and runtime behaviour across all actor types. That lets defenders see when an attacker pivots from one valid identity to another. Without that linkage, detections stay siloed and the attacker can disappear between tools.

Q: Why do service accounts and tokens create blind spots for threat detection?

A: Service accounts and tokens often carry valid access without a human interaction point, so network or endpoint tools may not explain whether the activity is expected. When those identities are separate from human governance, attackers can persist and move laterally while appearing legitimate to individual tools.

Q: How do teams know whether identity-based detection is working?

A: Look for detections that correlate identity, behaviour, and privilege changes across environments, not just isolated alerts. A working programme should identify unusual pivots between identity types, flag access that no longer matches historical behaviour, and reduce time spent stitching together events after the fact.

Q: What should organisations change in IAM when AI agents join the environment?

A: They should treat AI agents as governed identities, not just automation. That means placing them in the same visibility, entitlement review, and behavioural monitoring model as service accounts and human users, because their runtime actions can widen the attack surface quickly.

Technical breakdown

Why identity graphs matter for cross-surface detection

A unified identity graph links each identity to its permissions, relationships, and runtime behaviour across cloud, SaaS, CI/CD, and on-premises systems. That matters because identity attacks are rarely confined to one system boundary. A stolen credential can become a service account, then a token, then an AI agent execution path. Detection without a shared identity model becomes fragmented correlation rather than behavioural understanding.

Practical implication: map every identity type into one governance and detection model before trying to tune alerts or write detection rules.

Why human, NHI, and AI identities need one control plane

The article’s core technical point is that attacker movement often crosses identity types, not just technology layers. Human credentials may provide entry, but persistence often comes from machine identities, and AI execution roles can extend reach if they are not governed in the same policy fabric. Separate control planes create separate blind spots, especially when access is valid but behaviour is no longer normal.

Practical implication: align identity telemetry, entitlement review, and behavioural detection across human users, machine identities, and AI agents.

How threat research improves identity-based detection

The article highlights a detection model that is fed by in-house threat research and adversary patterns. That is technically relevant because identity detections improve when they are tied to real attack paths rather than generic anomalies. The value is not in volume alone, but in detections that understand how credential misuse, session hijacking, and privilege pivoting actually unfold.

Practical implication: validate identity detections against known attacker behaviours, not just static policy violations.

Threat narrative

Attacker objective: The attacker’s objective is to preserve valid access while moving laterally across environments and extracting data or control without triggering late-stage network-based detection.

1. Entry begins when attackers obtain an identity foothold through stolen credentials, compromised service accounts, or hijacked sessions rather than through malware or network exploitation.
2. Escalation occurs when the attacker pivots from the initial identity into other identities, using valid access to move from a human account into a service account or execution role.
3. Impact follows when identity pivoting enables persistence, lateral movement, and data access across cloud, SaaS, CI/CD, or on-premises environments.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Dropbox Sign breach — compromised Dropbox Sign service account exposed API keys and OAuth tokens.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-first detection is now a governance requirement, not a telemetry preference. The article reflects a wider shift in which attackers exploit identity continuity across human, machine, and AI actors. Security teams that still treat identity as one signal among many miss the operational reality that identity is often the attack path itself. The implication is that detection design now belongs in identity governance, not only in the SOC.

One graph is the right abstraction for multi-actor identity risk. When human users, service accounts, tokens, roles, and AI agents are modelled separately, pivoting attackers can disappear between systems. A unified identity graph creates the visibility needed to connect entitlement, behaviour, and runtime context. Practitioners should treat cross-identity linkage as the control objective, not an implementation detail.

Non-human identity exposure becomes more dangerous when AI execution roles are added to the stack. NHI programmes were already struggling with sprawl, over-privilege, and fragmented ownership. AI agents amplify that problem because they can inherit and traverse access at runtime. That means identity governance must now account for the combined blast radius of human, NHI, and agentic execution paths.

Identity-based threat detection reveals the gap between access and behaviour. A valid credential or token does not guarantee safe activity, and endpoint tools alone do not explain why access is being used the way it is. The article shows why behavioural baselines tied to identity context matter. The practitioner takeaway is to govern not only who can access, but what normal access looks like across actor types.

Cross-actor detection is where the market is heading because attackers already work that way. The vendor’s recognition reflects a category-level truth: the next generation of security tooling has to follow identity across boundaries that used to be siloed. That does not just improve detection. It forces IAM, PAM, and security operations to converge around shared identity context.

From our research:

• 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
• Another finding from the same survey shows that only 44% of organisations have implemented any policies to manage their AI agents, even though 92% say governing AI agents is critical to enterprise security.
• For a broader identity-risk lens, read Ultimate Guide to NHIs , Why NHI Security Matters Now for the governance pressures behind machine identity sprawl.

What this signals

Identity visibility is becoming the control plane for detection, not a supporting data source. As more access flows through machine identities and AI agents, security teams need behavioural telemetry that can follow an identity across environments and across actor types. The programme signal is clear: if you cannot trace privilege use from grant to runtime, you cannot trust the detection outcome.

AI access governance is already outpacing policy maturity. With 70% of organisations granting AI systems more access than they would give a human employee performing the exact same job, per the 2026 Infrastructure Identity Survey, identity programmes are being forced to manage exposure before they have standardised controls in place. That means entitlement review, logging, and behavioural baselining for AI agents should be treated as immediate operational work, not roadmap work.

Cross-actor detection will expose whether your IAM and SOC functions are actually integrated. The teams that can correlate identity context with runtime signals will spot pivot chains earlier, while siloed programmes will keep seeing only fragments. The practical signal to watch is whether IAM data is being consumed as a live detection input or only as an audit artefact.

For practitioners

• Unify identity inventories across actor types Build a single inventory for human users, service accounts, API keys, OAuth tokens, IAM roles, and AI agents so pivot paths can be traced across systems, not guessed after the fact.
• Instrument runtime identity behaviour Track what each identity does at runtime, not just what it was granted at provisioning, and flag pivots from one identity type to another as detection-worthy events.
• Tie detections to known identity attack paths Prioritise detections that match common credential theft, session hijack, and service-account pivot patterns rather than relying only on generic anomaly thresholds.
• Review AI agent access in the same governance flow Include AI agents in entitlement review, logging, and behavioural baselining so their execution roles do not become invisible extension points for attackers.

Key takeaways

• Identity-first threat detection matters because attackers increasingly move through valid identities rather than through obvious infrastructure compromise.
• The scale of the problem is growing because human, non-human, and AI identities now need to be observed as one connected attack surface.
• Teams should align governance, telemetry, and detection around identity behaviour across actors, or they will keep losing sight of attacker pivots.

Key terms

• Identity Graph: A unified model that links identities, permissions, relationships, and runtime activity across systems. In practice, it lets security teams see how a human user, service account, token, or agent connects to other identities and where a pivot becomes possible.
• Identity-First Detection: A detection approach that starts with the identity, then evaluates what it can access and how it behaves. It is especially useful when attackers use valid credentials or sessions, because the key question becomes whether the identity’s actions match its normal pattern.
• Runtime Behaviour Baseline: The expected pattern of activity for an identity while it is operating in production. It goes beyond entitlement lists by comparing actual actions, timing, and access paths, which is critical when valid credentials can still be abused.
• Cross-Actor Pivot: A change in attacker movement from one identity type to another, such as from a human account to a service account or AI agent. This matters because the attack can remain valid while the context changes, defeating siloed monitoring.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.

This post draws on content published by Permiso Security: Permiso Security Wins 2026 SC Award for Best Threat Detection Technology. Read the original.