Permiso leadership changes signal rising demand for identity security

At a glance

What this is: Permiso Security describes leadership changes alongside product momentum and argues that rising identity attacks are pushing inventory, posture and threat detection into a single operating problem.

Why it matters: IAM, NHI and autonomous identity teams need to treat identity visibility, threat detection and governance as a shared programme because attackers now exploit whatever identity type is easiest to impersonate or abuse.

Context

Identity security is the discipline of knowing what identities exist, what they can access, and how to detect abuse before it becomes outage or breach. In this article, the primary issue is not the leadership shuffle itself, but the market signal behind it: identity has become the control plane for human, non-human and AI access across cloud and SaaS environments.

Permiso Security frames its hires and promotions as a response to growing demand for identity security protection. The article also ties that demand to attacks that start with stolen identities or compromised credentials, which makes the governance question broader than classic account management and pushes it toward inventory, posture and threat detection together.

Key questions

Q: How should security teams handle identity risk when attackers use trusted access rather than exploits?

A: Security teams should treat trusted access as the primary control problem. The focus shifts from blocking entry to limiting what any valid identity can reach, chaining access can turn a normal login into a data theft path. That means inventorying identities, tracing dependencies and reducing privileged reach.

Q: How should IAM teams govern human, non-human, and AI identities together?

A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.

Q: What are the best practices for identity inventory in hybrid environments?

A: Use a continuous inventory that spans cloud, SaaS and delegated access paths, then keep ownership and privilege data linked to each identity record. Inventory should feed entitlement review, lifecycle decisions and alerting so teams can tell whether an identity is expected, active and appropriately scoped across environments.

Q: How do you know if identity threat detection is actually working?

A: Look for shorter mean time to detect and mean time to respond, plus fewer incidents where suspicious sessions persist for hours. Successful programmes also show accurate correlation between behavioural anomalies and real misuse, not just alert volume. If detection cannot trigger containment before damage spreads, the programme is still mostly observational.

Technical breakdown

Why identity inventory now sits next to threat detection

Identity inventory is the authoritative view of which human, non-human and AI identities exist, what privileges they hold, and where they operate. In hybrid and multicloud environments, that inventory is incomplete unless it spans cloud, SaaS and delegated access paths. Once attackers rely on stolen identities or compromised credentials, posture management alone is not enough because teams also need to know whether an identity should exist at all, who owns it, and whether it is still active across environments.

Practical implication: treat inventory as an active control surface, not a spreadsheet, and tie it directly to detection and revocation workflows.

How stolen identities become enterprise disruption

Credential theft changes the attacker model because the intruder no longer needs to break in through a noisy exploit path. They can log in, blend into normal access patterns, and pivot to systems and records that already trust the identity. That is why identity security programs increasingly combine posture, entitlement review and threat detection. The core failure is not just authentication weakness; it is the absence of continuous validation around whether the identity behaviour still matches the expected role and context.

Practical implication: correlate login behaviour, privilege scope and asset sensitivity so that valid credentials do not become silent persistence.

What AI changes in identity impersonation risk

AI does not automatically create autonomy, but it does make impersonation harder to spot because malicious activity can mimic normal communication and workflow patterns. In practice, that raises the bar for anomaly detection and identity context, especially when the same governance model must cover humans, service accounts and AI-enabled systems. The result is a broader trust problem: teams can no longer assume that a familiar-looking interaction is a genuine one without additional evidence from device, workload and behavioural context.

Practical implication: expand detection logic beyond static identity attributes and require behavioural context before granting trust to high-risk actions.

Threat narrative

Attacker objective: The attacker wants to use trusted identity access to reach systems and records, disrupt operations and increase pressure through theft or ransom.

1. Entry occurs when attackers use stolen identities or compromised credentials to sign in through legitimate access paths rather than exploiting a traditional vulnerability.
2. Escalation follows when the trusted identity is used to reach systems, records or operational functions that were not intended for that actor’s actual purpose.
3. Impact appears as system disruption, data access or ransom pressure, with the attack often blending into normal identity-driven operations until the damage is visible.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity security is becoming the control layer that unifies human, NHI and AI governance. The article is not really about personnel change. It is a market signal that organisations are collapsing separate conversations about inventory, posture and threat detection into one identity governance problem. That matters because the same access model now spans people, service identities and AI-enabled workflows, so programme design has to follow the identity fabric rather than the old tool silos.

Identity inventory is the named concept this market shift exposes. When an organisation cannot reliably enumerate human, non-human and AI identities, it cannot govern privilege, ownership or revocation with confidence. Permiso’s positioning reflects a broader reality: visibility is no longer a reporting function, it is the prerequisite for enforcement. Practitioners should read this as a sign that identity discovery and continuous validation are becoming core security operations, not optional hygiene.

Stolen identity abuse is overtaking exploit-centric thinking. The article links demand growth to attacks that begin with compromised credentials, which is exactly why identity controls now carry operational risk weight. Traditional perimeter logic breaks down when the attacker arrives through a valid session. The practical conclusion is that identity programmes must be measured by how quickly they identify abnormal use of legitimate access, not just by how many accounts they have enrolled.

AI raises the verification burden even when it does not create autonomy. The article’s reference to AI making impersonation harder to detect points to a future where familiar-looking behaviour is less trustworthy by default. That does not mean every AI-enabled system is autonomous, but it does mean governance teams need better evidence before accepting identity claims. The implication is that identity security will increasingly depend on context fusion across behaviour, workload and access history.

The market is moving toward converged identity operations rather than point capabilities. The combination of leadership hiring, product milestones and threat framing suggests that buyers are looking for one operating model for discovery, posture and detection. For practitioners, that means re-evaluating whether IAM, NHI and security operations are still run as separate programmes when the adversary already treats them as one surface. The discipline now is integration, not category loyalty.

What this signals

Identity security is moving from control category to operating model. The practical change for teams is that inventory, posture and detection can no longer be managed as separate workstreams if the same credentials and delegated access paths cross cloud, SaaS and AI-assisted workflows. The programme boundary is shifting from account administration to live identity governance.

Credential-led intrusion is the real driver of urgency. When attackers use stolen identities instead of obvious malware, the question becomes whether identity telemetry is rich enough to distinguish normal access from malicious use. That pushes security leaders to invest in context, not just coverage, because a valid session can be the start of the incident.

Identity discovery is now a prerequisite for resilient governance. If an organisation cannot enumerate what identities exist and who owns them, lifecycle controls and access reviews will always be incomplete. The near-term signal is that mature teams will tighten inventory discipline first, then use that foundation to rationalise posture, threat detection and response.

For practitioners

• Map the full identity fabric Inventory human, non-human and AI identities across cloud and SaaS so ownership, privilege scope and lifecycle state are visible in one place.
• Tie posture to detection Feed entitlement and configuration drift into identity threat detection so trusted credentials are assessed for misuse, not just existence.
• Review high-risk valid accounts Prioritise accounts that can access sensitive records or operational systems and verify whether their current access still matches business need.
• Harden impersonation controls Require stronger behavioural and contextual evidence before accepting identity claims that look normal but may be fabricated by attackers or AI-assisted activity.

Key takeaways

• Identity security is no longer a niche control area. It is becoming the common governance layer for human, non-human and AI access across modern environments.
• The article ties market demand to stolen identities and compromised credentials, which shows why valid access now matters as much as perimeter defence.
• Teams should respond by unifying inventory, posture and threat detection so identity abuse can be found and contained before it becomes disruption.

Key terms

• Identity Inventory: Identity inventory is the process of discovering and recording every identity that can access systems or data. For NHIs, it includes owner, purpose, privilege scope, lifecycle status, and where the credential is used. Without inventory, governance, audit evidence, and incident response all become partial and unreliable.
• Identity posture: Identity posture is the measurable state of who and what can access systems, data, and services at a given point in time. It covers human users, service accounts, applications, and external parties. Strong identity posture depends on visibility, entitlement accuracy, review cadence, and dependable offboarding.
• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Delegated access path: A delegated access path is the chain of identities, tokens, connectors, and approvals that lets one system act through another. It becomes a governance concern when the path outlives the original approval or can be reused for actions beyond the intended business purpose.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.