Topic starter
24/06/2026 10:41 pm
TL;DR: Identity-focused threat detection must follow attacks across human users, service accounts, API keys, OAuth tokens and AI agents, because modern intrusions pivot across identity boundaries faster than endpoint or network tools can track, according to Permiso Security. The real issue is not visibility alone but whether detection and response can preserve the attack thread as identities change.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “Permiso Security Named 2026 SC Awards Finalist for Best Threat Detection Technology”.
Key questions
Q: What breaks when threat detection is still split between human, NHI and agent tools?
A: The attacker disappears at the handoff.
Q: Why do identity pivots make endpoint-centric detections less reliable?
A: Because the attacker changes the observable surface before host-based logic can tell the full story.
Q: How do teams know whether identity-based detection is working?
A: Look for detections that correlate identity, behaviour, and privilege changes across environments, not just isolated alerts.
Practitioner guidance
- Map identity pivots end to end Trace how a compromise can move from a human user to a service account, token, role or AI agent in your environment, then verify that detections preserve that lineage.
- Unify identity telemetry across platforms Bring cloud, SaaS, CI/CD and on-premise identity events into a single correlation layer so account transitions are visible in one investigation flow.
- Review agent execution roles for excess reach Check whether AI agents can perform actions outside the immediate task scope or communicate in ways that bypass intended audit and approval boundaries.
Bottom line: Modern intrusions increasingly move across human, machine and agent identities inside a single attack path, so isolated identity views are no longer sufficient.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:29 am
Identity continuity is now the core detection requirement. The threat model is no longer about spotting a bad login in one lane of the environment. It is about tracking a single adversary as they move from human identity to NHI and into AI agent execution without losing the thread. That shifts the operational question from "what alert fired" to "can we still recognise the same attacker after the identity changes".
A question worth separating out:
Q: How should security teams govern agentic AI when agents can delegate to sub-agents?
A: Treat delegation as a first-class identity boundary. Define who can spawn sub-agents, how deep delegation may go, what scopes can be inherited, and when the chain must be revalidated. Without those controls, authority can expand faster than governance can attribute it, which is exactly where autonomous systems become difficult to contain.
👉 Read our full editorial: Identity-first threat detection now spans human, NHI and AI agents