Topic starter
03/06/2026 5:13 pm
TL;DR: RSAC conversations are shifting identity security from visibility to enforcement, with privileged access now extending far beyond human admins and AI agent transactions increasingly expected to fail policy rather than attack pressure, according to Silverfort. The control problem is no longer discovery alone, but whether access can be evaluated and blocked before action.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “After his eighth RSAC Conference, a CISO shares what’s changing in Identity Security”.
By the numbers:
- Through 2028, at least 80% of unauthorized AI agent transactions will be caused by internal violations of enterprise policies rather than malicious attacks, according to Gartner research cited by Silverfort.
Key questions
Q: What breaks when an identity security tool only provides visibility?
A: Visibility without lifecycle action leaves teams with better reporting but the same exposure.
Q: Why do vaults alone not solve privileged access risk?
A: Vaults protect where credentials live, but they do not control how those credentials are used once an identity is active.
Q: How should organisations govern AI agent access without losing operational speed?
A: Use task-scoped access, explicit human ownership, and runtime monitoring together.
Practitioner guidance
- Define enforceable AI agent usage policy Write explicit rules for what AI agents may access, what actions they may trigger, and which transactions require blocking or step-up control.
- Move PAM control points inline Evaluate whether privileged access decisions are being made at authentication and session start, rather than only at secret retrieval.
- Review privilege coverage across hybrid identities Map where privileged access exists outside legacy admin accounts, including service accounts, workload identities, and AI-driven actors.
Bottom line: The core identity-security problem is no longer visibility, but whether the programme can stop or constrain access before action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 5:17 pm
Identity governance is moving from observability to control enforcement. The old model assumed that seeing identities and their entitlements was the hard part. In practice, visibility without an inline decision point leaves organisations with a map of risk, not a way to stop it. The practitioner conclusion is that identity programmes now have to prove control at the moment access is requested, not only after the estate has been catalogued.
A question worth separating out:
Q: What is the difference between discovering identities and enforcing access decisions?
A: Discovery tells you what identities exist and what they can reach. Enforcement decides whether a request should be allowed, denied, or constrained before action occurs. The distinction matters because many identity programmes stop at inventory, which improves visibility but does not reduce the chance of misuse.
👉 Read our full editorial: Identity security is shifting from visibility to enforcement at RSAC