Topic starter
17/08/2026 4:38 pm
TL;DR: AI-driven attacks, machine identities, and agentic AI are expanding the identity attack surface while traditional MFA, roles, and manual governance were built for human-paced control loops, according to Saviynt. The practical break is that access decisions, review cycles, and anomaly detection now have to handle autonomous or semi-autonomous non-human identities, not just users.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Identities and IAM Trends: Q&A With Saviynt Identity Expert, Ehud Amiri”.
By the numbers:
- In a recent report, 87% of security professionals say they have faced an AI-driven cyber-attack in the last year.
Key questions
Q: What breaks when AI agents are governed with human IAM, IGA, and PAM models?
A: Human identity models assume a known person, a start date, a manager, and predictable access review cycles.
Q: Why do machine identities create more risk than human identities in some environments?
A: Machine identities are often numerous, long-lived, and embedded in code or infrastructure.
Q: How can security teams know whether continuous access risk visibility is working?
A: Security teams know continuous access risk visibility is working when new entitlements, role changes, and exceptions produce immediate and traceable risk signals.
Practitioner guidance
- Map all non-human identities to an accountable owner Build an authoritative inventory for service accounts, tokens, certificates and AI agents, and require each identity to have a named operational owner and a revocation path.
- Shift from periodic reviews to continuous access decisions Use risk-based signals, session telemetry and behavioural context to re-evaluate access during use, especially for privileged or high-churn identities.
- Separate human and non-human governance workflows Do not reuse human recertification and approval patterns for machine identities without redesigning them for machine speed, automated creation and rapid decommissioning.
Bottom line: AI agents and machine identities expose a basic mismatch between human-paced IAM controls and machine-speed access behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Human-centric IAM assumptions are being outgrown by machine-speed identity behaviour. The core problem is not that access controls disappeared, but that many of them presuppose a person in the loop and a stable access pattern. AI agents and machine identities can request, combine and use access in ways that outpace manual governance cycles, so the old review cadence no longer matches the risk cadence. Practitioners should reframe IAM as continuous identity governance across human and non-human actors.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What accountability model works for AI agents and other non-human identities?
A: Each non-human identity needs a named business owner, a technical owner and a defined revocation path. Without that accountability chain, access reviews can approve identities that nobody is actually responsible for, which is how orphaned privilege persists in distributed environments.
👉 Read our full editorial: AI agents are exposing IAM limits across human and machine identities