We’ re seeing the centre of gravity of cybersecurity settle around identity because attackers increasingly log in instead of breaking in.
fundamentally changing as attackers increasingly exploit trusted identities.
“ We’ re seeing the centre of gravity of cybersecurity settle around identity because attackers increasingly log in instead of breaking in. Once valid credentials are compromised, malicious activity can look remarkably similar to legitimate work. The recent Revolut incident is a useful example: Fraudulent requests came from a legitimate government email domain, so trust in the identity helped the attacker bypass normal suspicion.”
This requires organisations to reconsider permanent access privileges and adopt tighter controls around what identities are permitted to do.
“ That is why organisations must assume breach and focus on limiting what any identity can do, and for how long. The greatest exposure comes from standing privilege. Think of an administrator with permanent production access, a contractor account left active after a project, a service account with broad permissions, or an API key that never expires. Every scenario is a ready-made path for lateral movement that could reach sensitive data. Access should be just in time, just enough for the task, and removed automatically.”
The rise of machine identities
AI Agents push the numbers even further, often without an organisation realising.”
The problem becomes particularly significant when AI agents operate using the credentials and permissions of human users rather than possessing clearly separated identities.
“ An AI agent on a laptop often doesn’ t have an identity of its own. It borrows the user’ s, runs in their session and inherits whatever rights that session carries, which is exactly why standing local admin rights, standing cloud privileges and static secrets suddenly matter a great deal more than they did last year. If an AI agent approves its own request and something goes wrong, the audit log says the user did it. So when it tries to fix the database in production by deleting all the data, who is to blame?”
For CISOs, this creates fundamental questions around visibility, accountability and control.
“ The questions we need to ask are fairly blunt. Do you know which agents are running on your
The challenge is becoming more complicated with the rapid adoption of AI agents. Unlike conventional applications, agents can potentially interact with multiple enterprise systems and perform actions with limited human involvement.
Will Davies, Deputy CISO and Head of Enterprise Security at Endava
Will Davies, Deputy CISO and Head of Enterprise Security at Endava, says AI agents increase the number of identities organisations must secure and can take actions across multiple systems with limited human involvement. This creates risks around excessive permissions, unclear ownership, exposed credentials and unauthorised access.
“ Malicious instructions could also cause an agent to misuse legitimate permissions, potentially exposing data or changing business processes. Each agent therefore needs a clear owner, limited access, activity monitoring and the ability to be stopped or revoked quickly.”
James Maude, Field CTO at BeyondTrust, points to the sheer scale of the non-human identity challenge.
James Maude, Field CTO at BeyondTrust
“ Non-human identities already outnumber human ones by roughly 45 to 1 in a typical enterprise, and considerably more in cloud-native estates.
38 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST