may connect and how credentials are protected. Today, that is only part of the problem. A legitimate identity can still take an undesired action after access has been granted.”
This is pushing identity security towards controls that operate during active sessions rather than only at the point of authentication.
“ Identity security therefore must extend into the live session. The runtime authorisation solution which we showcased at GISEC evaluates access in real time and can apply policy to individual queries, commands and AI tool calls before they execute. That makes it possible to consider context continuously, limit access to the exact task and revoke it when the task ends or risk changes.”
Ayad describes this as an extension of existing identity infrastructure rather than its replacement.
“ This is an evolution, not a rip and replace exercise. IAM establishes identity. PAM secures privileged credentials and sessions. Runtime authorisation closes the gap between being allowed into a system and being allowed to perform a specific action inside it.”
From detection to autonomous response
AI will also increasingly sit on the defensive side of identity security. Continuous authentication, behavioural analysis and automated remediation could allow organisations to identify and respond to suspicious identity activity considerably faster.
But Maude cautions that increasing detection capabilities alone will not solve the problem.
“ The temptation is to focus on the signal side, because that’ s where a lot of the investment has gone. Continuous authentication, threat detection and behavioural monitoring is useful, and can help uncover some threats. The harder problem is what happens after the signal. More detection produces more findings, and most security teams are already carrying a backlog of risks they’ ve seen and haven’ t closed. AI that ranks that backlog is helpful, AI that can safely act on it could change the economics, but the constraint there isn’ t the model. It’ s whether the privilege and access underneath is safe to automate against.”
Standing and overly broad privileges make autonomous remediation particularly difficult because organisations need confidence that automated systems can act without disrupting critical operations.
“ If access is standing and broad, then there are bigger challenges. If the signal is missed because the attacker evaded detection, or the tuning wasn’ t good enough, then access is sat there waiting to be exploited. Even if the signals exist with poorly understood access, nobody will sign off on autonomous remediation, and they’ d be right not to. If it’ s built into privilege access workflows, granted just in time and removed when the work is done, automation has a far smaller and betterdefined surface to act on. Zero standing privilege is what makes autonomy achievable and affordable.”
Davies also expects AI and automation to shorten the gap between identifying suspicious behaviour and responding to it.
“ AI and automation will make identity security more responsive and reduce the time between detecting a threat and taking action.”
Continuous authentication could reassess trust throughout a session using contextual information rather than relying solely on an initial login.
“ Continuous authentication will reassess trust during a session using signals such as device health, location and unusual behaviour. AI will help identify excessive permissions and recommend safer access decisions. It will also connect activity across identities, devices and applications to detect suspicious patterns.”
The next step could be automated remediation, where access is restricted or removed as risks emerge. However, Davies stresses that autonomy will still require governance.
“ Automated remediation could restrict or revoke compromised access when agreed risk thresholds are met. However, these actions must have clear limits, audit trails, recovery procedures and human approval where critical services could be affected.”
As AI agents proliferate and identities increasingly operate at machine speed, the challenge for CISOs will extend well beyond determining who can access a system. Enterprises will need continuous visibility into what human and non-human identities can do, how privileges are being exercised and how those permissions connect to the wider attack surface.
The shift ultimately moves identity security from a gatekeeping function towards a continuous security discipline, where access, privilege, behaviour and risk are evaluated throughout the lifecycle of every identity.
40 WWW. INTELLIGENTCISO. COM / MIDDLE-EAST