Notifications
Clear all
Topic starter
17/08/2026 4:38 pm
TL;DR: AI-driven attacks, machine identities, and agentic AI are expanding the identity attack surface while traditional MFA, roles, and manual governance were built for human-paced control loops, according to Saviynt. The practical break is that access decisions, review cycles, and anomaly detection now have to handle autonomous or semi-autonomous non-human identities, not just users.
NHIMG editorial — based on content published by Saviynt: Identities and IAM Trends, a Q&A with Saviynt identity expert Ehud Amiri
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when identity governance is built only for human users?
A: Access review, joiner-mover-leaver processes, and periodic certification break down when the identity is a service account or autonomous agent.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: How do security teams know if continuous identity verification is working?
A: Look for a reduction in fraud that progresses beyond first-touch checks, plus faster escalation of risk scores when behaviour changes.
Practitioner guidance
- Inventory AI agents as first-class identities Create a separate inventory for AI agents, service accounts, tokens, and machine credentials.
- Shift to continuous access validation Extend authentication and session protection beyond login so risky behaviour can trigger re-authentication or step-up review during the session.
- Reduce standing privilege in machine workflows Remove unnecessary permanent permissions from machine and agent identities, then reissue access only for the workflow that actually needs it.
What's in the full article
Saviynt's full article covers the operational detail this post intentionally leaves for the source:
- The article's practitioner commentary on AI-driven phishing, deepfakes, and credential theft in identity attacks.
- The specific product and programme themes around AI-powered identity security, adaptive authentication, and automated governance.
- The source discussion of zero trust for identity, ISPM, and how Saviynt frames modernisation priorities for enterprises.
- The concluding guidance on converged identity controls for humans, machines, and AI agents.
👉 Read Saviynt's Q&A on AI-driven identity threats and NHI governance →
AI agent identity risk is forcing teams to rethink IAM controls?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
AI has become an identity attack multiplier, but the governance failure is still human-centric control design. The article is right that attackers are using AI to scale phishing, deepfakes, and takeover attempts. The deeper issue is that many programmes still assume identity abuse will arrive slowly enough for manual review to matter. That assumption no longer holds when both attack speed and identity sprawl have increased together, so practitioners need to treat identity telemetry as an always-on control plane, not a periodic audit trail.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how little of the machine identity estate is actually governed.
A question worth separating out:
Q: Who is accountable when AI-related access outpaces governance?
A: Accountability sits with the owners of identity, data, and platform controls together, because AI-related access problems cross programme boundaries. IAM, IGA, PAM, and security leadership must share responsibility for visibility, revocation, and ownership. If one team can create access but no team can remove it quickly, the control model is incomplete.
👉 Read our full editorial: AI agents are exposing IAM limits across human and machine identities
