A s attackers increasingly use legitimate credentials rather than exploit technical vulnerabilities, identity has emerged as one of the most critical enterprise attack surfaces. The rapid rise of AI agents and other nonhuman identities is adding another layer of complexity, forcing CISOs to rethink traditional approaches to access, privilege and identity security.
Modern enterprises operate across increasingly interconnected IT, cloud and operational technology environments. Within these environments, human users, administrators, contractors, service accounts, APIs and now AI agents can all possess identities and permissions that provide access to critical systems and information.
For attackers, compromising one of those identities can provide a relatively direct route into the enterprise.
Bernard Montel, EMEA Field CTO, Tenable, says identity has become a primary target because attackers recognise that compromising a set of credentials provides a direct, low-resistance path into an organisation’ s network without the need to exploit complex technical flaws.
Modern hybrid environments spanning Active Directory and Entra ID have created an interconnected web of human and non-human accounts, turning identity into the connective tissue across IT, cloud and operational technology. Organisations remain most exposed where they lack visibility into dangerous delegation chains, toxic privilege combinations and misconfigurations such as weak passwords or excessive permissions.
Bernard Montel, EMEA Field CTO, Tenable
Identity has become the new cybersecurity battleground. With AI agents adding millions of machine identities and permissions, enterprises must rethink how access is granted, monitored and controlled.
When these identity weaknesses intersect with traditional software vulnerabilities or exposed cloud workloads, they can create complete attack paths that allow malicious actors to move laterally and escalate access towards critical systems and sensitive data.
“ The exposure gap persists because security teams often monitor these identity silos independently rather than viewing them in the context of the broader attack surface, leaving hidden trust relationships unmonitored until an adversary exploits them,” says Montel.
Mortada Ayad, VP of Sales – META, Delinea, believes the nature of cyberattacks is
Mortada Ayad, VP of Sales – META, Delinea
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 37