endpoints? Do you know what they’ re permitted to do? And does a person still have to authorise the consequential actions? Most organisations can’ t answer the first question yet.”
Maude adds:“ A lot of this isn’ t even an AI problem, it’ s an ownership and privilege management problem running at machine speed.”
Beyond traditional IAM
As identity becomes intertwined with the broader attack surface, traditional identity and access management and privileged access management technologies are also evolving.
Montel says traditional IAM and privileged access management solutions are no longer sufficient on their own because they operate as isolated controls focused strictly on granting access rather than understanding how access is exploited. Point-intime scanning and siloed user management cannot keep pace with dynamic cloud environments or machine-speed attacks.
“ Modern threat landscapes require a fundamentally different approach rooted in exposure management, where identity security is continuously evaluated alongside assets, misconfigurations, and software vulnerabilities. Rather than treating identity hygiene as a standalone compliance exercise, security teams must map full attack paths to see how a single misconfiguration or excessive entitlement connects to an asset and creates a viable route for an attacker. By contextualizing identity risk across the entire digital footprint and utilising automated remediation workflows, organizations can proactively shut down lateral movement routes and neutralise identity threats before adversaries can weaponise them.”
Ayad similarly argues that IAM and PAM remain important but need to be complemented by controls capable of governing what happens after access has been granted.
“ Traditional IAM and PAM remain essential foundations, but they were built to answer who
This is an evolution, not a rip and replace exercise.
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 39