Notifications
Clear all
Topic starter
24/06/2026 10:41 pm
TL;DR: Identity-focused threat detection must follow attacks across human users, service accounts, API keys, OAuth tokens and AI agents, because modern intrusions pivot across identity boundaries faster than endpoint or network tools can track, according to Permiso Security. The real issue is not visibility alone but whether detection and response can preserve the attack thread as identities change.
NHIMG editorial — based on content published by Permiso Security: Permiso Security Named 2026 SC Awards Finalist for Best Threat Detection Technology
Questions worth separating out
Q: How should security teams detect attacks that move across human, NHI and AI agent identities?
A: Security teams should correlate identity events in one graph so a single attack thread stays visible as it crosses users, service accounts, tokens and agent roles.
Q: Why do service accounts and tokens complicate threat detection in cloud environments?
A: Service accounts and tokens complicate detection because they often operate without the human behaviours that traditional analytics expect.
Q: What breaks when endpoint tools cannot follow identity pivots?
A: What breaks is continuity.
Practitioner guidance
- Build one identity graph across users, NHIs and agents Unify cloud, SaaS, CI/CD and on-prem identity records so SOC detections can trace a session as it moves between people, service accounts and AI execution roles.
- Test for pivot visibility between identity classes Run purple-team scenarios where a compromised user credential is exchanged for a service account, then for an application or agent role, and verify that the chain remains visible end to end.
- Separate behavioural baselines by actor type Define different runtime baselines for human users, NHIs and AI agents so machine-paced activity is not misread as normal just because it is automated.
What's in the full article
Permiso Security's full blog post covers the operational detail this post intentionally leaves for the source:
- How Permiso's Universal Identity Graph models cross-cloud identity relationships in practice
- Examples of detection signals built from P0 Labs research and breach-response experience
- The platform's AI agent identity coverage and runtime identity posture details
- Why the SC Awards judging panel placed identity-first detection in scope
👉 Read Permiso Security's analysis of identity-first threat detection and AI agent coverage →
Identity-first threat detection: can your controls follow cross-identity attacks?
Explore further
25/06/2026 7:29 am
Identity has become the detection surface because attackers now move through identities, not just endpoints. Permiso Security's framing reflects a broader governance shift: modern intrusions often begin with a credential, then cross from human to machine to agentic execution if the control stack cannot correlate them. That makes identity context a SOC requirement, not an IAM afterthought. Practitioners should treat identity correlation as part of detection architecture.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI, which underscores how quickly identity governance is being outpaced by autonomous adoption.
A question worth separating out:
Q: Who should own identity-first threat detection in an enterprise?
A: Identity-first threat detection should be shared between security operations, IAM, cloud platform and NHI governance teams. SOC teams need the detections, IAM teams own the identity relationships, and platform teams understand where permissions and execution scopes are created. Without shared ownership, cross-identity attacks remain difficult to reconstruct and harder to stop.
👉 Read our full editorial: Identity-first threat detection now spans human, NHI and AI agents
