Notifications
Clear all
Topic starter
17/08/2026 5:39 pm
TL;DR: Identity threats now span human users, service accounts, OAuth apps and AI agents across cloud and SaaS, leaving traditional detection logic blind to authenticated abuse and privilege escalation, according to Unosecur. The practical shift is broader identity threat detection, because coverage gaps are now the main reason identity-based attacks keep succeeding.
NHIMG editorial — based on content published by Unosecur: No More Blind Spots: Unosecur Now Detects Identity Threats Across Cloud, SaaS, and AI Agents
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams detect attacks that move across human, NHI and AI agent identities?
A: Security teams should correlate identity events in one graph so a single attack thread stays visible as it crosses users, service accounts, tokens and agent roles.
Q: Why do non-human identities complicate identity threat detection?
A: Because their behaviour is machine-speed, highly repetitive, and tightly tied to workload context.
Q: What do security teams get wrong about AI agent and NHI monitoring?
A: They often treat monitoring as a logging problem instead of an identity governance problem.
Practitioner guidance
- Expand telemetry to every identity surface Connect cloud, SaaS, OAuth, service account, and AI agent signals into one detection workflow so identity abuse is visible across environments, not just at login.
- Build detections for authenticated abuse patterns Prioritise unusual consent, token misuse, privilege escalation, lateral movement, and first-touch sensitive data access because these are the events most likely to appear inside valid sessions.
- Create separate guardrails for AI agent identities Define which tools, data sets, and actions each agent may use, then monitor for scope drift, prompt injection effects, and unexpected multi-step behaviour.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Rule names and detection logic for specific identity behaviours across cloud, SaaS, and AI agents
- The exact 50+ integration coverage list across platforms such as AWS, Azure, GCP, Okta, GitHub, and Atlassian
- Examples of the 25,000+ unique detection scenarios mapped to identity-driven attack patterns
- The Vercel case walkthrough showing which alerts would fire at each identity hop
👉 Read Unosecur's analysis of identity threats across cloud, SaaS, and AI agents →
Identity threat detection across cloud, SaaS and AI agents?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 5:40 pm
Identity detection now has to follow the identity surface, not the infrastructure layer. The article is really about coverage drift, not just tooling gaps. Cloud, SaaS, and AI agents all produce valid identity events that can be exploited from inside trusted access paths, which means classic perimeter thinking is structurally too narrow. Practitioners should read this as a signal that identity telemetry has become the primary detection plane.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding shows that only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, which explains why coverage gaps persist.
A question worth separating out:
Q: Who is accountable when delegated OAuth access is abused?
A: Accountability sits with the organisation that allowed the app, the role owner who permitted broad authorisation, and the security team that failed to constrain the consent boundary. OAuth abuse is rarely a single-point failure. It is usually a governance failure across app approval, user entitlement, and admin awareness.
👉 Read our full editorial: Identity threat detection now has to cover cloud, SaaS and AI agents
