Notifications
Clear all
Topic starter
26/08/2026 11:50 am
TL;DR: AI systems and automated threats are pushing identity security beyond authentication toward verified authorization, with Yubico saying OpenAI now requires hardware-backed passkeys for all members of its Trusted Access for Cyber program. That shift matters because software-only controls do not reliably protect high-consequence actions, and human intent verification becomes a governance requirement as AI use expands.
NHIMG editorial — based on content published by Yubico: Q2 commentary on hardware-backed trust, AI authorization, and compliance continuity
By the numbers:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, ahead of inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
Questions worth separating out
Q: What should security teams govern beyond employee login controls?
A: Security teams should govern contractor access, supplier access, service credentials, and any other identities that can reach critical systems.
Q: Why do hardware-backed passkeys matter for identity governance?
A: They reduce the chance that a reusable secret becomes the weak point in a phishing or replay attack.
Q: When do AI agent workflows need stronger approval controls?
A: Any time an agent can initiate actions with operational, financial, or security impact.
Practitioner guidance
- Separate login assurance from action approval Map which workflows need only strong authentication and which require verified human intent before execution, especially for signing, privileged changes, and AI-assisted approvals.
- Define explicit approval boundaries for AI agents Document which agent actions are allowed, which need step-up approval, and which are prohibited before granting broader tool access or delegation.
- Align regulated workflows to validated hardware Use FIPS-validated authenticators or modules where compliance requires them, then pair them with lifecycle controls, access scoping, and audit trails.
What's in the full article
Yubico's full post covers the operational detail this analysis intentionally leaves for the source:
- The specific hardware-backed authorization model behind verified approval for high-consequence actions.
- The FIPS 140-3 validation details for the YubiKey and YubiHSM portfolio in regulated environments.
- The OpenAI Trusted Access for Cyber requirement that members adopt hardware-backed passkeys.
- The post-quantum readiness and standards work referenced in the company’s roadmap and ECSO participation.
👉 Read Yubico’s analysis of hardware-backed trust for AI authorization and compliance →
Hardware-backed trust for AI agents and high-consequence actions?
Explore further
26/08/2026 11:51 am
Identity assurance is moving from authentication to action authorisation. The article reflects a broader shift in which identity security is no longer satisfied by proving who signed in. What now matters is whether a high-consequence action was intentionally approved by the right actor at the right moment. That change affects human IAM, PAM, and NHI governance alike, because the trust boundary has moved from entry to execution.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, which reinforces why approval trust cannot stand alone.
A question worth separating out:
Q: What is the difference between strong authentication and verified authorisation?
A: Strong authentication proves the identity subject has a trusted factor, such as a hardware key or passkey. Verified authorisation proves that a specific high-consequence action was intended and approved. Organisations need both when the risk is not just account takeover but misuse of legitimate access.
👉 Read our full editorial: Hardware-backed trust for AI authorization and compliance continuity
