Notifications
Clear all
Topic starter
08/07/2026 7:05 pm
TL;DR: AI is making phishing, session hijacking, and over-permissioned identities easier to exploit, while runtime context is becoming essential for spotting anomalous access and lateral movement, according to Bitwarden's conversation with Rinki Sethi. The governance gap is no longer whether identities can authenticate, but whether teams can see and constrain what they do after access is granted.
NHIMG editorial — based on content published by Bitwarden: a conversation with Rinki Sethi on AI, identity security, and runtime defence
Questions worth separating out
Q: How should security teams detect identity abuse after login succeeds?
A: Security teams should monitor the authenticated session, not just the login event.
Q: Why do over-permissioned identities increase breach impact so quickly?
A: Over-permissioned identities act like master keys.
Q: What do security teams get wrong about AI in the SOC?
A: Teams often confuse assistance with authority.
Practitioner guidance
- Prioritise runtime identity telemetry Correlate identity, session, workload, and secret activity so you can detect behaviour that diverges from the approved access pattern.
- Review over-permissioned accounts first Identify identities that can unlock multiple systems from a single compromise point, especially in cloud and SaaS estates.
- Separate AI assistance from AI authority Classify which operational actions may be recommended by AI, which may be executed automatically, and which require human approval.
What's in the full article
Bitwarden's full conversation covers the operational detail this post intentionally leaves for the source:
- Rinki Sethi's direct examples of how AI is changing attacker tradecraft and defensive workflows.
- The interview segment on runtime detection, session hijacking, and why static identity checks are no longer enough.
- The discussion of human-in-the-loop boundaries for AI-assisted security operations and escalation decisions.
- The rapid-fire identity investigation questions that show how a CISO prioritises post-breach analysis.
👉 Read Bitwarden's conversation on AI-driven identity risk and runtime defence →
AI agent governance: what existing IAM teams are missing?
Explore further
08/07/2026 7:29 pm
Identity is now the primary attack surface because access is easier to steal than to defend. The article reinforces a basic shift in the field: attackers do not need to break the system if they can borrow a legitimate identity. That reality affects human IAM, service accounts, and AI-enabled workflows alike, because valid access now does most of the attacker’s work. Practitioners should treat identity compromise as the default breach path, not an edge case.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: How do identity logs help after a suspected compromise?
A: Identity logs show who accessed what, when, and from where, which makes them the first source for understanding post-authentication abuse. They help reconstruct session hijacking, privilege misuse, and lateral movement better than endpoint data alone. If the question is how far trust was extended, identity logs usually answer it first.
👉 Read our full editorial: AI agent identity risk is outpacing enterprise IAM controls
