Topic starter
06/06/2026 2:14 am
TL;DR: C1.ai argues that the CIA triad was designed for a perimetered world where identity was assumed, not governed, while cloud, SaaS, APIs and AI agents make actor identity the control plane for access, trust and accountability. The deeper issue is that data protection and actor governance now sit in separate layers, so adding identity as a fourth pillar only partially solves the problem.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “The CIA Triad Was Built for a World That No Longer Exists”.
Key questions
Q: What breaks when identity is treated as a secondary control beneath the CIA triad?
A: What breaks is the sequencing of trust.
Q: Why do SaaS-heavy environments make identity governance harder than older perimeter-based models?
A: SaaS-heavy environments increase the number of access paths, endpoints, and collaborators that security teams must govern.
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate.
Practitioner guidance
- Map identity as a separate control layer Document where your security architecture currently assumes identity is solved upstream, then mark every place where confidentiality, integrity or availability decisions depend on actor verification.
- Rebuild controls around actor lifecycles Define how human users, service accounts and AI agents are created, authorised, reviewed and removed, with explicit ownership for each lifecycle path.
- Review workload and API trust paths Inventory the services, APIs and workloads that authenticate to each other and confirm that tokens, scopes and renewal rules match actual runtime behaviour.
Bottom line: The article argues that the CIA triad was built for environments where identity was already settled, which is no longer true in cloud, SaaS and AI-driven estates.
What's in the full article
C1.ai's full blog covers the argument this post intentionally leaves at the architecture level:
- The historical progression from Bell-LaPadula and Biba to the CIA triad, including why that lineage matters for modern governance
- The article's five-step account of how cloud, SaaS, APIs, remote work and AI agents eroded perimeter-based security assumptions
- The breach examples used to support the identity-first argument, including Midnight Blizzard, Change Healthcare, Snowflake, Okta and PowerSchool
- The author's case for treating identity as a separate layer rather than only a fourth pillar inside the existing model
👉 Read C1.ai's analysis of why identity is the missing layer in modern security →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:46 am
Identity is not a subcomponent of the CIA triad. It is a separate layer of governance above the properties the triad was built to protect. Confidentiality, integrity and availability describe what must be true about data, but identity determines who is allowed to affect that data in the first place. That difference matters because the modern attack surface is increasingly actor-driven rather than perimeter-driven. The practitioner conclusion is that actor governance now deserves its own architectural treatment, not just a supporting control.
A question worth separating out:
Q: Should organisations add identity as a fourth pillar or redesign the security model entirely?
A: Adding identity as a fourth pillar is a useful step, but it does not fully solve the architectural problem if actor governance and data protection remain separated. Organisations should use it to force a redesign of access governance, lifecycle management and runtime authorisation, not just rename the framework.
👉 Read our full editorial: Identity is the missing layer in the CIA triad for modern security