Identity threat detection now has to cover cloud, SaaS and AI agents

At a glance

What this is: This is an analysis of why legacy identity detection misses cloud, SaaS, and AI agent abuse, and the key finding is that identity-based attacks now exploit blind spots across every identity type.

Why it matters: It matters because IAM, IGA, PAM and detection teams now have to govern identities that behave differently, including non-human and autonomous ones, or risk missing authenticated attack paths.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.

👉 Read Unosecur's analysis of identity threats across cloud, SaaS, and AI agents

Context

Identity detection was built when the main subjects were people, a few service accounts, and a narrow set of cloud controls. That assumption no longer holds, because cloud workloads, SaaS integrations, OAuth grants, tokens, and AI agents now generate the same kind of authenticated activity that defenders expect from legitimate users.

The problem is not only scale, it is identity surface drift. Security teams often have coverage for login events and endpoint telemetry, but they do not have equivalent behavioural detection across third-party integrations, non-human accounts, and agentic systems that can act at machine speed.

That creates blind spots that attackers can exploit without needing malware or perimeter compromise. In an identity-led environment, the question is whether detection logic follows the identity wherever it operates, including across cloud, SaaS, and autonomous workflows.

Key questions

Q: How should security teams detect attacks that move across human, NHI and AI agent identities?

A: Security teams should correlate identity events in one graph so a single attack thread stays visible as it crosses users, service accounts, tokens and agent roles. The key is to detect transitions, not just events. If each identity class is monitored separately, the attacker can pivot silently between tools and still look normal in isolation.

Q: Why do non-human identities complicate identity threat detection?

A: Because their behaviour is machine-speed, highly repetitive, and tightly tied to workload context. A detector that only understands human logins will miss suspicious automation or generate too many false alarms. Teams need baselines built from task patterns, entitlements, and system relationships so that alerts reflect real identity misuse.

Q: What do security teams get wrong about AI agent and NHI monitoring?

A: They often treat monitoring as a logging problem instead of an identity governance problem. More telemetry does not help if the programme cannot tell which behaviour is expected, who owns the identity, or what an anomaly means in context. Monitoring must be tied to identity semantics, not raw event count.

Q: Who is accountable when delegated OAuth access is abused?

A: Accountability sits with the organisation that allowed the app, the role owner who permitted broad authorisation, and the security team that failed to constrain the consent boundary. OAuth abuse is rarely a single-point failure. It is usually a governance failure across app approval, user entitlement, and admin awareness.

Technical breakdown

Why identity-based detection misses SaaS and cloud abuse

Identity threat detection and response works by correlating authentication context, behavioural baselines, privilege use, and access anomalies. The failure point in many stacks is scope: they instrument one control plane well, but not the connected identity surfaces where OAuth grants, shared accounts, and service credentials actually move. Once attackers operate through legitimate sessions, the telemetry looks authorised unless the detection model understands identity intent, sequence, and context across systems. That is why platform coverage matters more than single-point alerts in hybrid estates.

Practical implication: Map detection coverage to each identity surface and verify that cloud, SaaS, and integration telemetry all feed the same anomaly model.

How AI agent identity changes the detection problem

AI agents are not just another workload. When they hold credentials, call APIs, and choose actions at runtime, their behaviour must be analysed as identity behaviour, not only application behaviour. The important distinction is autonomy versus automation. A scripted workflow is still a non-human identity pattern, but an agent that can redirect its own actions, chain tools, and continue operating after manipulation creates a broader detection problem because harmful behaviour can look internally consistent. Traditional thresholds are weak against that kind of drift.

Practical implication: Treat AI agents as governed identities and build detection rules for prompt injection, scope drift, and privilege misuse in agent workflows.

Why authenticated attack chains evade perimeter and endpoint controls

Many modern identity intrusions never need endpoint malware or a network exploit. The attacker uses a valid token, a consented OAuth grant, a misused service account, or a redirected session and then moves laterally through identity infrastructure. Because each step is authenticated, the chain can look normal to perimeter tools. The real signal is behavioural sequencing, such as unusual consent, identity infrastructure access, first-time sensitive data access, and cross-environment movement. Detection has to understand the chain, not only the event.

Practical implication: Correlate consent, access, reconnaissance, and first-touch data events so authenticated abuse is visible as a sequence, not isolated noise.

Threat narrative

Attacker objective: The objective is to move through trusted identity paths, expand access, and reach sensitive systems or secrets without being detected by perimeter controls.

1. Entry occurs through a compromised credential, OAuth grant, or redirected session that gives the attacker authenticated access without triggering classic malware-based defenses.
2. Escalation follows when the attacker uses that legitimate foothold to reach identity infrastructure, enumerate resources, or access sensitive data outside the normal behavioural baseline.
3. Impact is achieved through lateral movement, secret discovery, and production environment exposure, with the attacker staying inside trusted identity pathways long enough to extract value.

Breaches seen in the wild

• CoPhish OAuth Token Theft via Copilot Studio — CoPhish campaign exploits Microsoft Copilot Studio agents to steal OAuth tokens via AI-assisted phishing.
• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity detection now has to follow the identity surface, not the infrastructure layer. The article is really about coverage drift, not just tooling gaps. Cloud, SaaS, and AI agents all produce valid identity events that can be exploited from inside trusted access paths, which means classic perimeter thinking is structurally too narrow. Practitioners should read this as a signal that identity telemetry has become the primary detection plane.

AI agents are becoming a distinct detection class, not a feature of existing IAM logic. When an agent can call tools, hold credentials, and act at runtime, its misuse is not captured by human-centric baselines or ordinary workload rules. That moves AI agent security into the same governance conversation as NHI, but with added behavioural complexity. The implication is that agent activity needs dedicated identity policy, not just application monitoring.

Identity-based intrusion is now a sequencing problem. The attacker rarely needs to break in through one dramatic step. Instead, they combine consent abuse, token misuse, reconnaissance, and first-touch access into a chain that looks legitimate at each individual hop. This is where identity threat detection must become stateful across systems, because single-event alerting leaves the chain intact.

Unified detection across human, non-human, and autonomous identities is becoming the baseline expectation. The old assumption was that human identity controls, NHI controls, and cloud detection could be handled separately. That model no longer matches how attacks move. The practical conclusion is that governance and detection programmes now have to share the same identity inventory and behavioural model.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• A separate finding shows that only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, which explains why coverage gaps persist.
• For a deeper governance lens, see Ultimate Guide to NHIs for lifecycle, visibility, and offboarding controls that apply across machine identities.

What this signals

Identity threat detection will keep converging with identity governance. As more access lives in OAuth grants, service accounts, and AI agents, the detection team can no longer operate without the same authoritative inventory used by IAM and IGA. With 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security, the first challenge is still knowing what exists.

Identity surface drift is now a programme risk, not just a tooling issue. The gap forms when cloud, SaaS, and AI agent activity outpaces the security model that was originally built for human logins. That is why identity threat detection, access governance, and privilege review have to share one inventory and one set of ownership rules.

Detection accuracy will increasingly depend on lifecycle discipline. If access is never inventoried, recertified, or revoked cleanly, behavioural analytics inherit stale assumptions about what a subject should be doing. The result is false confidence, not better control.

For practitioners

• Expand telemetry to every identity surface Connect cloud, SaaS, OAuth, service account, and AI agent signals into one detection workflow so identity abuse is visible across environments, not just at login.
• Build detections for authenticated abuse patterns Prioritise unusual consent, token misuse, privilege escalation, lateral movement, and first-touch sensitive data access because these are the events most likely to appear inside valid sessions.
• Create separate guardrails for AI agent identities Define which tools, data sets, and actions each agent may use, then monitor for scope drift, prompt injection effects, and unexpected multi-step behaviour.
• Correlate identity hops into one incident view Link the initial foothold, identity infrastructure access, and downstream access events so analysts can see the full chain before the attacker completes exfiltration or environment enumeration.

Key takeaways

• Identity-based attacks now exploit trusted sessions, OAuth grants, and service credentials rather than obvious perimeter failures.
• The scale of the visibility problem is already severe, with 85% of organisations lacking full visibility into third-party vendors connected via OAuth apps.
• Practitioners need unified identity telemetry and dedicated AI agent guardrails, or detection will continue to miss the chain of abuse.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• OAuth Grant Abuse: OAuth grant abuse happens when a previously approved third-party application or integration is used in ways that exceed the original access intent. The grant remains technically valid, which makes misuse harder to spot unless teams monitor consent patterns, scope creep, and downstream access paths.
• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.
• Cross-surface identity drift: Cross-surface identity drift is the movement of identity trust across endpoints, browsers, SaaS, cloud, and service layers faster than governance can track ownership. It becomes dangerous when one valid credential or token can be reused to progress through multiple control domains without reauthorization.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• Rule names and detection logic for specific identity behaviours across cloud, SaaS, and AI agents
• The exact 50+ integration coverage list across platforms such as AWS, Azure, GCP, Okta, GitHub, and Atlassian
• Examples of the 25,000+ unique detection scenarios mapped to identity-driven attack patterns
• The Vercel case walkthrough showing which alerts would fire at each identity hop

👉 Unosecur's full blog covers the identity hops, alert examples, and AI agent detection rules in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.