They can identify misconfigurations and sensitive data, but they do not tell you which agent can act on that data or which tool chain can reach it. Without identity context, teams may know where the data is, but not who or what can use it.
Why This Matters for Security Teams
CSPM and DSPM are useful, but they answer the wrong question for agentic AI: they show where misconfigurations and sensitive data exist, not which CSA MAESTRO agentic AI threat modeling framework identity can reach that data, invoke a tool, or chain an action into a breach. For autonomous workloads, identity is the control plane. Without it, a clean posture scan can coexist with an agent that has excessive runtime access, an exposed secret, or a tool path into regulated data. NHIMG research shows only 1.5 out of 10 organisations are highly confident in securing NHIs, which is a warning sign when AI agents increasingly depend on short-lived credentials and API-driven reach.
This gap is easy to miss because cloud posture tooling often reports configuration state at rest, while AI risk emerges at request time, across systems, and through execution paths that are not visible in a storage-first view. A dataset can be classified correctly and still be reachable by an over-privileged agent, a plugin, or a downstream workflow that no scanner was designed to model. In practice, many security teams discover this only after an agent has already been granted tool access rather than through intentional AI identity governance.
How It Works in Practice
The practical failure is that CSPM and DSPM are control-point tools, while AI security needs execution-point controls. CSPM can flag public buckets, open security groups, or weak cloud settings. DSPM can classify sensitive records and trace where they live. Neither one can reliably answer: which agent is authenticated right now, what workload identity it presents, what secrets it can mint, or whether its next action is permitted in context. That is where identity-aware governance comes in, using workload identity, policy-as-code, and runtime authorization.
For agentic systems, the better pattern is to combine posture findings with identity and policy signals. That usually means:
- Binding each agent, service, or tool runner to a workload identity such as SPIFFE/SPIRE or OIDC-backed credentials.
- Issuing Anthropic Project Glasswing style runtime access only when a task needs it, then revoking it on completion.
- Evaluating permissions at request time with policy-as-code instead of assuming static RBAC will fit autonomous behaviour.
- Cross-checking sensitive data locations from DSPM with live access paths so security teams can see not just where data sits, but which identity can actually touch it.
That operational model is reinforced by the same attack patterns seen in NHIMG research on the DeepSeek breach and 12,000 Secrets Found in Public LLM Training Dataset, where exposed secrets and broad access made downstream misuse far easier than posture tools alone would suggest. These controls tend to break down when agents can dynamically chain tools across multiple cloud accounts and SaaS systems because neither CSPM nor DSPM natively models end-to-end execution authority.
Common Variations and Edge Cases
Tighter visibility often increases operational overhead, requiring organisations to balance faster detection against runtime complexity. That tradeoff is especially visible in environments with many ephemeral agents, shared tool gateways, or loosely governed SaaS integrations. Current guidance suggests that CSPM and DSPM still matter, but only as inputs to a broader control model that also includes identity, secrets hygiene, and runtime policy enforcement.
There is no universal standard for this yet, so teams should be explicit about scope. In some environments, DSPM will correctly identify sensitive content but miss access through an agentic workflow. In others, CSPM will highlight a permissive cloud role while missing the fact that an agent can mint fresh credentials on demand. The right question is not whether data is visible or misconfigured, but whether any agent can use that data to take an action. That is why NHI governance has to sit alongside posture management, not inside it, and why MAESTRO-aligned review is increasingly used as a bridge between cloud posture and AI execution risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic systems need runtime identity and tool-use controls beyond posture scanning. | |
| CSA MAESTRO | MAESTRO models agent behavior, tool chains, and trust boundaries CSPM/DSPM miss. | |
| NIST AI RMF | AIRMF addresses governance gaps when AI systems act on sensitive data autonomously. | |
| OWASP Non-Human Identity Top 10 | NHI-01 | NHI identity is required to know which non-human actor can reach sensitive data. |
| NIST Zero Trust (SP 800-207) | SC.L1-1 | Zero trust requires request-time verification, not trust based on cloud posture alone. |
Add runtime authorization and tool-access checks for each agent action, not just cloud posture review.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 25, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
