Topic starter
24/06/2026 10:41 pm
TL;DR: Cross-identity attack paths defeat split detection because attackers can move across human, machine and agent identities inside one intrusion, Permiso Security explains. Identity lineage and cross-platform correlation are needed to keep the same attacker traceable as privileges and surfaces change.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “Permiso Security Named 2026 SC Awards Finalist for Best Threat Detection Technology”.
Key questions
Q: Why do identity pivots make endpoint-centric detections less reliable?
A: Because the attacker changes the observable surface before host-based logic can tell the full story.
Q: How do teams know whether identity-based detection is working?
A: Look for detections that correlate identity, behaviour, and privilege changes across environments, not just isolated alerts.
Q: What breaks when threat detection is still split between human, NHI and agent tools?
A: The attacker disappears at the handoff.
Practitioner guidance
- Map identity pivots end to end Trace how a compromise can move from a human user to a service account, token, role or AI agent in your environment, then verify that detections preserve that lineage.
- Unify identity telemetry across platforms Bring cloud, SaaS, CI/CD and on-premise identity events into a single correlation layer so account transitions are visible in one investigation flow.
- Review agent execution roles for excess reach Check whether AI agents can perform actions outside the immediate task scope or communicate in ways that bypass intended audit and approval boundaries.
Bottom line: Modern intrusions increasingly move across human, machine and agent identities inside a single attack path, so isolated identity views are no longer sufficient.
Glossary terms: Identity-first fraud prevention, Identity Lineage, Cross-identity attack path, Agent execution identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:29 am
Identity continuity is now the core detection requirement. The threat model is no longer about spotting a bad login in one lane of the environment. It is about tracking a single adversary as they move from human identity to NHI and into AI agent execution without losing the thread. That shifts the operational question from "what alert fired" to "can we still recognise the same attacker after the identity changes".
A question worth separating out:
Q: How should security teams govern agentic AI when agents can delegate to sub-agents?
A: Treat delegation as a first-class identity boundary. Define who can spawn sub-agents, how deep delegation may go, what scopes can be inherited, and when the chain must be revalidated. Without those controls, authority can expand faster than governance can attribute it, which is exactly where autonomous systems become difficult to contain.
👉 Read our full editorial: Identity-first threat detection now spans human, NHI and AI agents