Notifications
Clear all
Topic starter
30/07/2026 11:21 pm
TL;DR: AI agents are accelerating credential discovery, permission abuse, and attack propagation across hybrid identity environments, while identity teams are also being asked to harden recovery and boundary controls before failure, during active attack, and after compromise, according to Semperis. The central issue is not AI adoption itself, but the collapse of identity assumptions when agents can act at machine speed.
NHIMG editorial — based on content published by Semperis: Introducing AI Agents to Your Identity Fabric
By the numbers:
- Identity-based attacks rose 32% in just the first half of 2025, according to Microsoft.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do hybrid identity environments increase risk for agentic AI?
A: Because attackers and rogue agents can exploit the seams between directories, vaults, and cloud identity systems.
Q: What breaks when AI agents are given standing privileges?
A: Auditability, containment, and accountability all degrade.
Practitioner guidance
- Map every identity provider in the hybrid estate Build a single inventory that includes AD, Entra ID, Okta, Ping, connected service accounts, and every AI agent that uses credentials.
- Eliminate standing privilege for AI agents Convert privileged access to just-in-time, just-enough, ticket-bound access with automatic expiry.
- Classify and right-size non-human identities Discover all machine identities, service accounts, and agent credentials, then remove unused entitlements and shared secrets.
What's in the full article
Semperis's full article covers the operational detail this post intentionally leaves for the source:
- The step-by-step hardening checklist for hybrid identity estates spanning multiple IdPs and agent credentials.
- The specific recovery sequence for restoring identity cleanly after compromise, including identity-specific backups.
- The exact machine-speed detection and auto-revert workflow for suspicious privileged identity changes.
- The practical guardrails for agents acting as humans, including dual-key approval for Tier 0 access.
👉 Read Semperis's checklist for preparing identity fabric for agentic AI →
AI agents and identity fabric risk: are your controls keeping up?
Explore further
30/07/2026 11:24 pm
Identity fabric is now the control plane for agentic AI risk. The article correctly treats identity as the last perimeter because agents still need credentials, roles, and authorization paths to do work. That means the security question is no longer whether AI can act, but whether the identity layer can constrain what it is allowed to reach. For practitioners, the implication is that AI governance and identity governance are now the same operating problem.
A few things that frame the scale:
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
A: Accountability should sit with the owner of the trust decision, not only the team operating the tool. For critical infrastructure, that may be the identity and access owner, the privileged access owner, or the business function that approved delegation. When agentic access is involved, the sponsoring human and the system owner both need clear responsibility.
👉 Read our full editorial: AI agents are exposing identity fabric gaps at machine speed
