Introduction

Identity security threat modelling is a structured way of identifying how an attacker could abuse, bypass, or manipulate the components that make up an identity systems to gain unauthorised access, support data ex-filtration or disruption to core services.

As identity and access management (IAM) has become more important - and moved from being a tactical and reactive component, to more strategic and proactive - by design it has become a target for both internal and external malicious operators.

The vulnerabilities within the IAM landscape are both numerous and often difficult to identify. And whilst our approach to controls selection has improved, as an industry we are facing considerably more automated and sophisticated approaches that exploit weakness across the entire IAM landscape.

Organisations have numerous issues to contend with. Existing IAM infrastructure is often isolated, disconnected and delivered by a patchwork quilt of different vendors and homegrown components. A lack of visibility and central control is also likely. This contributes to a general lack of visibility - visibility as it pertains to infrastructure usage and configuration, but also with respect to identity usage too.

Hybrid deployments - with both applications, relying services and IAM components - are also common, with PaaS, SaaS and on-premise deployments resulting in inconsistent user experiences for both administrators and end users, alongside common mis-configuration issues.

To that end we need to combine some existing concepts in new ways - both existing threat modelling and our knowledge of IAM components and usage flows.

Read more

Let us take a step back before focusing our attention on agentic identity. If we think merely in terms of humans and existing intent management capabilities, intent management relates to the analysing and predicting user behaviour through classic behavioural science and digital signals.

The core concept involves understanding what a user is likely to do - mainly in terms of buying signals or decision-making - taking a look at either their physical body language, or more latterly by analysing their digital body language.

This includes thousands of behavioural micro-expressions captured while a user interacts with a digital interface - perhaps an advert, digital store front or filling out an online application. From there marketing technology (martech) scoring functions can be used to identify if a user is “mad, sad or glad” when interacting with a piece of digital content.

This “intent data” can be used to better predict and react to user signals in real time - either by showcasing different products or adverts.

Of course these concepts can also be applied to information security - and in the digital setting trying to “spy the lie” as it pertains to access management such as on-boarding or authorization decision making and enforcement.

Specifically from an identity security perspective, this connects to broader themes around runtime attribution - namely understanding who is doing what and why. Digital attribution can leverage the ability for biometric lineage and tying back an event to a specific identity. This not only helps with traceability but also contributes to risk analysis and composite understanding regarding motive and opportunity with respect to malicious behaviour. Of course not all identities will have biometric attributes - aka non-human identities or agentic-identities so we need to consider how to proxy this.

But returning back to intent, we need to consider where it sits in the overall identity security space and then specifically within agentic-identity security.

Can we therefore start to think of a simple and broader identity security question that intent management can help solve?

The word “trusted” here is important (as opposed to trustworthy). Trusted is more likely aligned with a volatile action and changeable decision. Trustworthy is more likely to an inherent repeatably proven trait. For example boot attestation may result in a measurably “trustworthy” operating system. A process on top of that is “trusted” after obtaining specific credentials.

Let us move back to agentic-identity security. Two other ingredients are needed for our “Trusted Interaction” story: authorization and guardrails. (N.B Authorization is such a large topic it will be treated in a separate cheat sheet).

Authorization will require several well known building blocks: policy decision points, policy enforcement points and of course a policy to link those together. In the framework above, authorization is determining whether an agent should have “read” or “read and write” access based on rules, context, the task being completed and so on.

The intent aspect is going to analyse whether the agent is using that “read” access to read a document to complete legitimate work, or read a document to send to a nation state for espionage purposes.

Guardrails are merely there to help with prompt engineering, ingress and egress filtering and helping to define the outer bounds of expected behaviour.

This is taken from The Cyber Hut’s Academy series Episode 41 “What is Agentic Identity Security - Part 1”

The Cyber Hut Academy - IAM and Identity Security Training

41: What is Agentic Identity Security - Part 1?

Read more

12 days ago · 3 likes · The Cyber Hut

The Why

Why has Intent Management become interesting now? Isn’t this just the same as standard behaviour monitoring that we have seen with user entity behaviour analytics (UEBA) or more latterly in concepts like identity threat detection and response (ITDR)?

Yes, and no.

Intent management is a critical mechanism in agentic identity security that focuses on validating the underlying rationale and expected behavioral boundaries of an autonomous AI agent's actions. This generates some subtly new requirements.

Traditional identity security platforms had evaluated whether a user has permission to access an object or resource.

Agents introduce two more subtle issues: a level of autonomy and optimisation. Both of which result in the now commonly used term “non-deterministic” behaviour. Essentially we can’t easily predict what the agent will do. Some of its moves will seem strange - but will be entirely legitimate - some of its moves will seem “OK” but will be entirely malicious. It is also quite likely that access changes, multiple-system usage and a broad array of permissions is entirely likely during the completion of a task. Knowing what to allow, block and monitor is complex.

So we move away from a simple authorization decision + monitor pattern, to something more along the lines of "Yes, they have permission to do something, but why are they doing it now, and is it expected?”.

This layer of security addresses the behavioural reality that autonomous agents do not operate within human social constructs - that of trusted colleagues for example.

Capabilities

Capabilities in this area are both new and evolving rapidly. However, we can frame our thinking about what questions we want to answer. The following is taken from our Academy episode 42 “What is Agentic Identity Security - Part 2” that takes a high level look at the top 6 control areas we need to consider for risk reduction. Part 6 is about observability and intent.

Here we need to look at what agent is trying to do - what has it done before in the current sequence and can we predict a sequence of events going forward? What triggered it and has it been influenced in anyway?

Example capabilities to consider should include:

• Runtime observability - being able to both monitor, judge and respond during post-provisioning and post-authentication events - the judging aspect may well be another LLM powered component

• Intent declaration - for any drift or analysis steps to take place, the agent must declare that it intends to do - and this needs capturing with integrity protection

• Sequence and access path tracking - it’s important not to just analysis the agent during a single API call or access request - but look at before and potentially the after steps in the full access path

• Intent drift - once the intent has been declared, deviations from that first need to be analysed and then responded to

• Context grounding - an ability to know not only the owner/agent trigger, but also the context the user-lineage operates in to find deviations

• Purpose-driven policy - access policies are important, but must not fall into the basic coarse-grained models - they must be specific, fine grained and linked to the purpose at hand

• Graduated-response - risk will be volatile and not all responses should be allow/deny - with a flexible way of handling evaluated risk. E.g. honeypot, monitoring, degradation etc

Example Vendor Solutions for Intent Based Access Control & Management

Apono (now part of 1Password)

Apono implements intent-based access control by shifting from static rules to context-aware, just-in-time (JIT) runtime authorization for both human and AI agents. Using the Agent Privilege Guard, it validates declared intentions in real-time, enforcing least-privilege access and automatically revoking permissions to eliminate standing privileges.

Apono positions itself at the intersection of dynamic access control, identity-native security, and modern operations by delivering Zero Standing Privileges (ZSP) and friction-free, Just-in-Time (JIT) access across cloud services, databases, and servers. Moving away from traditional, static vault-centric architectures, the platform manages risk through an iterative lifecycle of discovery, detection, assessment, and policy-driven control. Its core innovation revolves around "Access Flows" and dynamic "access guardrails".

Clvr Security

Clevr Security manages intent specifically for AI agents, copilots, and autonomous workflows through Intent Analysis at the execution boundary. Instead of just analyzing prompts or applying static rules, they evaluate the underlying intent of an agent’s multi-step plan before any action is allowed to run. They describe three main aims:

1. Goal Drift Detection

• Multi-Step Tracking: Clevr tracks every step of an agent’s plan against the user’s original instruction.

• Off-Script Flags: It catches the exact moment an agent’s goal shifts from what was authorized (e.g., if a task is to “send a report,” but the agent’s plan expands to “query all contacts” and “export to external storage”).

2. Pre-Execution Interception

• Context Accumulation: The platform continuously accumulates session state and historical context to weigh the agent’s current action against its stated intent.

• Real-Time Intervention: If an action is deemed “out of bounds” or misaligned with the original intent, Clevr intercepts it before it reaches business systems, routing the request to Deny, Modify, or Escalate for human approval.

3. Intent-Driven Policy Enforcement

• Live System Checks: It maps the agent’s intent against real-time business parameters like change windows, budget caps, data sensitivity, and segregation of duties.

• AARM Compliance: Clevr aligns its intent validation with the AI Agent Runtime Security (AARM) open standard, specifically fulfilling requirements for pre-execution evaluation and identity-to-intent binding.

Kontext Security

Kontext addresses intent-management within its runtime authorization framework by treating intent as a core variable to compare requested actions with authorized tasks. Rather than relying solely on credentials or token presence, the system evaluates the underlying reason for an action to protect against vulnerabilities like prompt injection and excessive agency. Kontext structures and manages intent include:

1. Interception at the Action Boundary

Kontext positions its runtime policy checks immediately preceding tool invocation, API execution, or data access. Intercepting actions at this boundary ensures that a model’s generated plan can be analyzed before any external side effects occur.

2. Processing Structured Intent Context

The authorization system processes an explicit JSON payload detailing the runtime intent. Key evaluation variables include:

• Declared Task: The specific task the agent is trying to complete.

• Source: The origin of the instruction (e.g., user prompt vs. third-party data inputs).

• Confidence Scores: Structural context determining how confidently the intent matches authorized workflows.

• Session History: Context chains that look at prior tools called and data accessed to catch drift or multi-hop data exfiltration paths.

3. Mitigating Malicious Purpose Mapping

Kontext uses intent data to differentiate between identical API calls carrying vastly different risk profiles. For example, a policy can evaluate the task intent to allow a standard tool read parameter while simultaneously blocking a bulk export triggered by an indirect prompt injection payload.

4. Auditable Evidence Generation

Intent classification functions as a required log parameter for framework compliance, such as the NIST AI Risk Management Framework (AI RMF). Kontext logs the classified intent alongside the specific user delegation path, agent identity, parameters, and matching policy version to generate an immutable, reviewable audit trail.

Oasis Security

Oasis Security manages intent through a capability called Agentic Intent & Access Control, which is a core component of its Agentic Access Management (AAM) platform. Rather than relying on traditional, rigid static roles and permissions, Oasis focuses on understanding why an AI agent is requesting access before granting it.

This can be described in three main areas:

1. Intent-Aware Access Decisions

• Context Over Permissions: The platform actively analyzes the real-time context of what each non-human identity or AI agent is doing and why.

• Dynamic Approval: Instead of granting permanent privileges, access control decisions are tightly bound to the agent’s specific, declared intent at that moment.

2. Time-Bound Governance

• Automated Provisioning: Oasis automatically maps and provisions the specific permissions an agent needs to execute its task.

• Time Restrictions: Access is strictly time-bound. The moment the agent’s intent is fulfilled or the allowed window expires, the access is automatically restricted or removed to prevent over-privileged standing access.

3. Comprehensive Ecosystem Integration

• Cross-Environment Tracking: Oasis tracks agentic intent across a wide hybrid footprint, including cloud providers (AWS, Azure, GCP), development hubs (GitHub), data ecosystems (Snowflake, BigQuery), and AI endpoints (ChatGPT, Copilot, Bedrock).

• Inventory & Visibility: It creates a real-time inventory that ties every active AI agent identity back to a clear human owner or core internal system, ensuring that intent can always be traced back to an accountable source.

PlainID

PlainID addresses intent management through its recently launched Agentic Identity Platform, which utilizes Intent-Based Access Control (IBAC) to secure AI agents, Retrieval-Augmented Generation (RAG) systems, and Model Context Protocol (MCP) tool flows.

1. Intent-Based Access Control (IBAC)

• Moving Past Static Roles: PlainID shifts authorization away from rigid user roles to dynamically evaluate what an AI agent intends to execute in real time.

• End-to-End AI Boundaries: It defines and enforces clear guardrails across the entire AI session lifecycle to dictate what an agentic identity can safely access, modify, or expose.

2. Runtime Authorization & Zero Standing Privileges

• Dynamic Decision Engine: Every intent is intercepted and parsed by a smart decision engine that applies fine-grained precision and context to the request.

• Just-In-Time Rules: Instead of allowing persistent background data access, permissions are granted dynamically for the specific task at hand, enforcing Zero Standing Privileges across connected apps and databases.

3. Policy-Based Access Control (PBAC) Standardization

• Unified Policy Language: PlainID allows organizations to write an authorization policy once and distribute it everywhere across SaaS apps, APIs, microservices, and AI models.

• Integration Hub: It embeds directly into AI frameworks (like LangChain) to evaluate intent natively before the agent calls an external data platform or internal service.

4. Agentic AI Observability

• Auditable Intent Traces: The platform logs every agent action, intent evaluation, and authorization decision into clear, business-readable language.

• Compliance & Governance: Security teams and auditors can track exactly why a bot requested a specific tool execution and how the policy reacted to it.

Reva

Reva.AI brands itself as the industry’s first Intent & Behavior Based Access Control (IBAC) platform. They treat intent not just as a buzzword, but as the strict “semantic backbone” of least-privilege authorization for autonomous AI agents.

According to their technical framework, Reva.AI implements intent-based access control through the following core technical mechanisms:

1. The Core Paradigm Shift: “Actions to Intents”

Traditional access control answers who can invoke an API. Reva’s IBAC shifts the entire authorization question to: “For the current task and context, is this specific action over these resources allowed?” It decouples security from static roles and maps access directly to a defined purpose.

2. The 5-Step Runtime Enforcement Architecture

Reva maps out a concrete technical pipeline that executes at machine speed before an agent can cause damage:

• Step 1: Intent Templates: Organizations define canonical, YAML-style templates for workflows (e.g., patch_production_service). These explicitly specify allowed actions, resources, and hard constraints (like max lines edited or database rows read).

• Step 2: Parsing Natural Language: A classifier or small LLM maps a user’s natural language instruction into one of these strict template formats.

• Step 3: Fine-Grained (FGA) Mapping: Reva’s platform acts as a “policy generator,” translating that approved intent into standard Fine-Grained Authorization (FGA) tuples (e.g., agent:read#table:finance_2025).

• Step 4: Cryptographic Intent Tokens: At the start of a session, Reva binds these allowed tuples and constraints into a highly temporary, signed JWT token.

• Step 5: Gateway Interception: The Reva Trust Gateway checks every single tool or Model Context Protocol (MCP) call against the token. If the agent tries to wander off-script—even due to prompt injection or model hallucination—the gateway hard-blocks the tool execution before it hits production systems.

3. Domain-Specific Ontologies

Instead of generic guardrails, Reva structures intent around a domain-specific vocabulary mapping Users/Agents, Tasks, Actions, Resources, and Constraints. This enables highly contextual rules, such as allowing a healthcare agent to read patient labs for a “clinical review” task, but automatically denying the action if the agent attempts to mass-export the data.

4. Built on Open Standards

Rather than forcing proprietary lock-in, Reva applies its intent management layer on top of industry-standard policy languages and engines like Cedar, OPA (Open Policy Agent), OpenFGA, and AuthZEN.

Silverfort

Silverforts’s recent acquisition of Fabrix adds further agentic-centric decision capabilities to their existing ITDR plans.

They address intent management by treating AI agents as dynamic, non-human identities and applying identity-first runtime protection to control their actions. Rather than allowing an agent to wander “off-script,” Silverfort mitigates behavioral drift and malicious intent by intercepting unauthorized tool and access requests before they execute.

They handle intent and runtime security through several key capabilities:

1. Stopping Behavioral Drift and Misguided Intent

• Detecting Deviant Behavior: Silverfort continuously monitors agent sessions for internal risks, specifically focusing on “behavioral drift”- instances where an autonomous agent acts outside its original intent or designated scope.

• Blocking Attack Delegation: It detects and blocks prohibited agent-to-agent delegation chains, ensuring an agent cannot pass instructions or privileges to another bot to bypass restrictions.

• Defending Against Malicious Override: Its runtime layer stops external, adversarial intents like prompt injections or poisoned Model Context Protocol (MCP) servers from hijacking the agent’s logic.

2. Dual-Architecture Runtime Enforcement

Silverfort ensures that regardless of an agent’s intended action, it must clear a hard identity policy boundary via two enforcement methods:

• MCP Gateway (Universal Inline Security): For custom or open-framework agents using the Model Context Protocol, Silverfort routes traffic through an inline MCP Gateway. It evaluates the agent’s identity and policy in real time, intercepting unauthorized tool calls before they hit internal data servers.

• Native Platform Integrations: For cloud-managed ecosystems (like Microsoft Copilot Studio or Google Cloud Agent Gateway), Silverfort embeds directly into the platform’s control plane to block actions without requiring separate traffic routing.

3. Least-Privilege Identity Binding

• Context-Aware Decisions: Every access request is evaluated against a centralized policy defined by the agent’s identity, the user context, the target application, and the specific action type.

• Eliminating Over-Privileged Access: By continuously mapping agents to clear human owners and auditing their exact blast radius, Silverfort ensures agents do not possess standing privileges that exceed their day-to-day administrative intent.

Teleport

Teleport recently released an Agentic Identity Framework - covering a broad array of use cases to protect the agentic life cycle and runtime access.

The framework manages intent by enforcing strict cryptographic bindings and infrastructure boundaries, rather than interpreting natural language. It secures agentic intent through "Identity-to-Intent" binding, delegated authorization, dynamic ABAC, and granular auditing of tool execution.

Teleport defines Identity-Intent Binding through a zero-trust, infrastructure-first approach that treats AI agents as distinct, authenticated workloads rather than relying on reactive text-based analysis. Their strategy utilizes ephemeral, hardware-isolated runtimes and short-lived cryptographic certificates to enforce strict, "steady-state" computing where agent access is bound to specific, time-limited tasks.

Recommendations

The rise of agentic AI strips away a fundamental assumption that identity security has relied on for decades: predictability. When autonomous, non-deterministic agents are given the keys to enterprise data ecosystems, static roles and traditional privilege monitoring are no longer enough to prevent catastrophic drift or malicious exploitation. Security can no longer safely operate on an “allow or deny” permission structure when an agent’s technical access looks perfectly legitimate on paper but deviates entirely from its actual business task.

Intent-Based Access Control (IBAC) represents the necessary evolution of zero-trust architecture for the AI era. By forcing agents to declare their goals, tracking their multi-step execution paths, and binding identity directly to an authorized purpose in real-time, security teams can safely govern systems without choking innovation.

To prepare enterprise infrastructure for non-deterministic workloads, identity and security architects must transition from static access management to dynamic runtime controls.

Some core initiatives to consider over the next 90 days:

• Consider Intent Declaration: Mandate that any autonomous agent or copilot must cryptographically or programmatically declare its multi-step execution path before it is granted access to high-value enterprise endpoints.

• Establish Identity-Intent Binding: Bridge the attribution gap by ensuring every API or database call initiated by an agent inherits a time-bound, ephemeral token that explicitly maps back to a verified human owner and a specific, approved business goal.

• Monitor and Mitigate Intent Drift: Deploy boundary instrumentation capable of checking the state of a live session. If an agent shifts from its declared task (e.g., changing a task from “summarising data” to “exporting data”), the platform must instantly flag the drift or automatically revoke access - essentially an observability problem.

• Adopt Graduated-Response Policies: Move away from binary “allow/deny” logic. For ambiguous or moderate-risk agent behaviour, implement flexible, automated guardrails such as routing requests to a human-in-the-loop approval queue, downgrading session permissions, or steering the agent into an isolated monitoring sandbox.

About The Author

Simon Moffatt has over 25 years of experience in IAM, cyber, and identity security. He is the founder of The Cyber Hut, a specialist research and advisory firm based out of the UK. He is the author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker, and a strategic advisor to entities in the public and private sectors.

Last updated 29 June 2026.

Book Consultation to Discuss

Share The Cyber Hut Radar - Emerging Technology Research

Identity-aware modern privileged access management (PAM) introduces the ability for organisations to deliver improved capabilities for discovering, securing and monitoring privileged…

Read more

Non-human discover-ability, runtime controls and agentic intent management are now becoming table stakes - in conversations at least.

Has the AI-identity era begun, or are just saying goodbye to the beginning of IAM as we know it?

Last week I braved the 41 degree heat to travel over to Las Vegas for the Identiverse 2026 event. As always, an immersive 4 day conference, with a range of established and emerging vendors, practitioner talks, breakout sessions and of course World Cup games.

Whilst I didn’t attend as many event talks as I would have liked, vendor briefings, side hustles, beer and coffee chat and general wanderings proved incredibly insightful to what is happening and what may be emerging.

What it is in the Rear View Mirror

Technology evolves, standards come, go and come back again and capabilities disappear. Several “perfect storm” moments are happening in identity right now and are changing entirely how we design, buy and think about IAM features.

Zero Trust, Cloud and API Economy

Let’s start with a few givens. The multi-decade migration to zero trust (ZTNA) is of course still a thing. Many organisations are not fully there and are slowly but surely embracing a perimeter-less approach to data access, edge security and continuous forms of authentication and access management. No one explains this anymore. Business cases rarely need to be made internally, but the implementation, migration and operational management still needs to be done. All in ZTNA is just the defacto way of discussing general network security - and of course IAM is central to this design paradigm.

Two other concepts that are really just “givens” are the cloud-first consumption of IAM features and the ability to consume these services as APIs. Absolutely the “hybrid” deployment approach is and will continue to be a thing for a long time yet - and this is something I’ve discussed many times on The Analyst Brief Podcast - but these two non-functional requirements are the default deployment and consumption facade and not the exception.

The general narratives from vendors and system integrators follows this, with the general assumption that a buy-side org will engage with identity services via a subscription, cloud and API deployment that will fit natively into a “continuous” IAM strategy that supports ZTNA. Of course, what “continuous IAM” actually is I will cover later.

Moving Towards Obsolescence

Of course AI is and was everywhere. Nearly every (maybe every) vendor had some narrative around AI. Perhaps securing all of AI (ambitious) or more likely agentic-identity security. Suddenly, since the end of say 2024 we’re seeing many often confusing, conflicting and sometimes conflating ideas, questions and concepts relating to AI security.

We see two distinct phases: AI for IAM and IAM for AI. If we tackle the former for a moment and add in some ideas around what might suddenly start to become obsolete from an IAM point of view in the not too distant future. Of course any predictions of the like are able to come back and haunt, so take this with a pinch of salt.

What can AI help us with in the IAM world and let us get on with some “real problems”.

1. Populating descriptions for AD group, roles and policies: this is boring manual work that expensive humans hate. We avoided it and the result was group and role explosions.

2. Access review certifications: instead of managers rubber-stamping yes/no on lists they don't understand, AI can pre-analyse each entitlement, flag anomalies and recommend approve or revoke with a rationale, reducing certification to exception handling.

3. Writing access request justifications: users currently struggle to articulate why they need access; AI can draft the justification based on their role, peer group and the resource being requested, reducing friction and improving audit quality

4. Application on-boarding and connector configuration: mapping an application's roles, attributes and entitlements into an IGA or access management platform is largely a pattern-recognition task - either for filling in template documents or perhaps even building the basic connector

5. Writing and maintaining access policies: this is a game changing one, and may not be entirely made redundant, but translating business rules like "only finance team members in the EU can access payroll data during business hours" into formal policy syntax (XACML (remember that?), OPA, Rego, Cedar et al) is exactly the kind of structured translation task AI handles well, removing the bottleneck between business intent and technical policy enforcement

Many of the above are likely to get to the 80% “automagic” point (see Pareto Efficiency for that) without really start to “cost” anything. The last 20% might well start to make other areas less well off in the short term, but humans getting involved just for the “last mile” exceptional cases would be a huge improvement.

What Car Are We Tailing

So we can definitely see “light” at the end of the old-world IAM tunnel with many issues hopefully starting to disappear - or at least move towards a potential obsolescence time line. But we can’t just put our feet up at this point.

We (as identity and cyber security nerds) now have more to worry about, as instead of just fixating on human-identity, we have to manage non-human and agentic-identity too.

Identiverse generated many interesting points around AI and agentic security - some exciting, some insightful, some obvious, some very wrong (?!), some tedious but all entirely useful as signals to what is happening in both the vendor land and practitioners worlds.

Let me jot down a synthesised view of some of the key statements and questions that dominated many of conversations and briefings I had last week:

Statements

1. Agentic access without governance is a risk

2. Secrets sprawl is the new shadow IT

3. NHI: the identity problem nobody planned for

4. Non-human identities now outnumber human identities in the enterprise

5. AI agents are the new insider threat vector

6. Every AI agent needs an identity, a role and an access policy

7. Agents amplify the weaknesses inherit in human authorization management

Questions

1. Who authorises the AI agent?

2. Who should access an AI agent?

3. How to support JiT/ZSP for agents?

4. How to find an owner for an agent?

5. Can you revoke access from an AI agent in real time?

6. Can you see all of your AI agents?

7. What happens when your AI agent gets compromised?

8. Does your IAM strategy cover non-human identities?

9. What is intent management?

So we have the fear - volume, variety and vulnerability - and the complexity - intent, governance and management.

I would like to add in a few more comments here. We need to step back a little and think about what we really want to fix as an industry. If we return back to the World Cup for a second, Agentic-identity is a little like a friendly match before the tournament starts, or perhaps the first half of group game 1. It’s frantic, hot, full of mistakes and to be honest, the result doesn’t mean a great deal. But we can use it to learn.

We are very early with respect to deployment, design patterns, standards and real world experience when it comes to agentic-identity. Yes AI and specifically agentic-deployments are sky rocketing, but equally we don’t have decades worth of project scars to rely upon. We are generating more questions than answers right now, and that is perfectly fine.

But it is important to work out what is tactical versus what is long term and strategic.

Tactical Concerns

1. Securing MCP

2. Securing RAG

3. Agentic Discovery and Ownership

Stragetic Concerns

1. Attribution and Intent (biological, lineage, behaviour, accountability)

2. Trusted Interactions (humans, non-humans, agents, service providers)

3. Data Authentication and Integrity (organisational, geo-politcal, societal)

The divide between tactical and strategic is important - namely as the tactical phases of technology evolution are moving increasingly fast. AI makes feature acquisition “fast” - in the sense incumbent platforms can extend at the edge of their horizontal capabilities very quickly. Previously this may have required acquisitions or partnerships. Today that means AI-assisted development.

As today we see “AI Security” and “Agentic Security” vendors, whereas tomorrow all “infosec vendors” will be AI and agentic security vendors by proxy.

Further Resources:

Where Are We Heading

The strategic concerns are really where we we are heading towards - with several bumps in the road as we get there.

There has been considerable uptick in the past 24 months in concepts like data encryption, post-quantum crypto, crypto-agility and authorization. None are AI-specific, but AI deployments are amplifying vulnerabilities in some of these core areas.

A more AI-centric concept that has emerged both in 2024 and certainly at Identiverse was that of Intent Management. (This is a concept The Cyber Hut are actively tracking and are looking to release a cheat sheet on this in July 2026 - if you are a vendor in this area get in touch for a briefing).

I will cover intent in more detail next month, but essentially agentic access management requires three distinct anchor components:

1. Guardrails (outer bounds for expected behaviour - prompting, ingress, egress)

2. Authorization (PDP/PEP, PBAC, JiT)

3. Intent Analysis (behaviour, drift, sequencing)

What do these components ultimately do? They identify risk (at runtime), detect if a composite threshold has been reached and do something about it. Both the “threshold” crossing and “do something about it” are still very much in their infancy but solutions are developing rapidly here. For certain the response will be more than just an “allow or deny” and must contend with fine grained access changes, perhaps deceptive redirection and monitoring along with degradation and disruption ideas.

Bumps in the Road

Several conversations (nods to the likes of Transmit, Descope and LoginRadius here) have touched on the agentic-commerce area - with agents operating on the behalf of a consumer. This can have some very interesting consequences with respect to how a service provider binds and owns a B2C identity. Will the agent essentially act as a barrier to a personalised experience and disrupt data capture? Or improve privacy? The ability to expose services, products, pricing and the like to AI search engines is popular. The secondary aspect here is to expose agents that can in turn “talk” to agents operating on-behalf-off (OBO) of a B2C identity. This is emerging and patterns have not become stable.

A further comment on intent and agentic behaviour observation. A term that is popping up more is that of an LLM “judge” or observer. This is essentially trying to act as the independent analyser of behaviour that also carriers the same non-functional characteristics of the thing it is monitoring - namely optimization and learn-from-doing.

To that end are we simply heading to a “robot-wars” scenario, where only AI can protect AI?

Event Shout Outs

I did manage some “time out” from briefings and the Expo floor and shout outs to P0 Security, The Identity Underground, Silverfort, Britive and Saviynt for some great post-event “parties”.

Thanks also to those that attended The Cyber Hut watch event for the England -v- Croatia World Cup game at Flanker Kitchen and Sports Bar. Great turnout and an England victory!

Podcast Shout Outs

Thanks also to the Silverfort Identity Decoded Podcast and Saviynt SaviTalk Podcast for having me on your shows and the great conversations. Watch out for when those shows drop soon!

Vendor Briefing Shout Outs

As a former vendor guy for 15 years I understand totally that conferences can be exhausting for vendors. Customer meetings, prospect meetings, partner meetings, VC meetings, then booth duty, then having to brief analysts on your current (and often changing) plans. I spoke to many vendors last week, but a specific shout out to those I met for 1-2-1s and briefings:

Aembit, AppViewX, Britive, C1, Crowdstrike, Descope, ManageEngine, Ory, P0 Security, Redblock, Reva, Saviynt, Silverfort, Stackbob, WSO2

Further Training Resources:

The Cyber Hut Academy - IAM and Identity Security Training

39: Just-in-Time Access and Zero Standing Privileges Explained: The Future of Least Privilege

Read more

4 months ago · 3 likes · The Cyber Hut

The Cyber Hut Academy - IAM and Identity Security Training

33: What Role does AI play in IAM?

Read more

a year ago · The Cyber Hut

Follow The Cyber Hut TV

Carry on the Chat - The Cyber Hut Slack

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut - a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

Read more

• Scale - volume, throughput, usage

• Complexity - security, usability, privacy and personalisation

• Flexibility and modularity

Identity and Access Management (IAM) is more than just the login box. Whilst that is the first thing many customers and citizens encounter when they attempt to access a downstream system or application, the underlying capabilities and skills required to build such an authentication flow are clearly more complicated than that. In addition, authentication is only ever part of a broader set of requirements that span the entire end to end life-cycle of an identity - from acquisition and on-boarding to storage, session management, privacy and robust access control.

The counter point of course, is that you can go faster on your own, but further in a crowd and in some respects that applies perfectly to IAM platforms. Whilst many initiatives often start with minimal IAM requirements, they can rapidly morph into a sprawling mix of security, data, scale and privacy needs. At first glance the initial signup and sign-in flows seem like easy candidates for self-build and DIY initiatives but will soon run into scale and complexity challenges.

Scale is not just associated with the volume of identities from a storage point of view though - we need to also consider concepts such a throughput - which is likely to be non-linear and elasticity. By this I mean there is a certain level of uncertainty and uncontrollability in B2C and even B2B2x environments where throughput for both signup and sign-in can vary hugely during particular external events - such as competitions, marketing campaigns or government deadlines. A more recent amplification of scale requirements comes in the form of NHI and agentic identity - where volume of identities and transaction rates for things like authorization enforcement are considerably higher than traditional environments.

From a feature requirements perspective too, we also see several conflicts - the classic security versus usability aspect and also personalisation versus privacy - which can be complex to solve with homegrown and DIY solutions.

Secure, Usable and Privacy Enabling

• Evolving Threats and Standards

• Compliance and Consent

Supporting both a usable and secure, compliant and omni-channel experience that empowers and attracts end users requires a blended approach of many different options.

Building that for one application or service is possible - but a strategic view of IAM requires that to be completed for all systems and services, in a repeatable and cost effective manner. This latter point is becoming increasingly important - as poor experiences certainly impact sign up and in turn revenue generation - and combining that with the personnel costs of home grown solutions can result in a significant negative cost situation.

The impact of strategically supporting a usable experience across multiple applications, sites and brands is complex. It requires a deep understanding of end user types and preferences, subtle differences in localization and age-related patterns of usage as well as supporting a variety of options for authentication, signup, transaction processing and content management. Whilst some of those signals are controllable, the security aspect may not be.

B2C identity introduces considerably more uncontrollable elements than workforce identity. Not only are volume, growth and throughput often difficult to estimate, external threats and changes in the tactics, techniques and procedures (TTPs) used by adversaries changes constantly. Traditional ways of approaching external facing sites was to build first and test last - as seen with the classic pen-test way of performing periodic validation of external facing components.

This has evolved hugely in the past decade and the advent of AI-centric continuous testing can allow development teams to build security in from the start, with code and dataflow analysis allowing immediate comparison to compliance requirements and the organisational risk posture.

The constantly evolving threat landscape is only one aspect of the many uncontrollable aspects of B2C and B2C IAM development. Standards such as OAuth2, OIDC, SCIM, FIDO and more lately AI related MCP and AgentAuth whilst mature in many respects have numerous profiles and implementation patterns that do change and require adherence to. With a specific focus on AI, more recent design patterns focused upon harness engineering and plugin-development is a good example where solution emergence often occurs faster than operational design.

Open standards provide numerous benefits including improved interoperability, simpler design and threat modelling, and knowledge economies of scale with respect to repeatable integration options. However, attempting to conform to open standards in-house requires both deep specification and also time and effort with respect to tracking, understanding and often participating in standards groups.

What Production Platforms Enable

• Managing Uncertainty

• Future Proofing - Building for AI and Beyond

Uncertainty in both technology evolution and B2C identity environments cannot be avoided or removed - but it can be managed. A core benefit of a production IAM platform is that it can cloak both the business and technical change that is constantly occurring. Changes in scale, standards, application integration requirements or privacy enablement are not one-off periodic considerations that would historically have been managed by long-tail Waterfall methodologies for development. They need to be handled not in a periodic way, but in a more continuous and iterative manner - by the selection of composable capabilities as and when they are needed.

A production IAM platform like Ory supports a modular and customizable deployment model. This deployment model must support a range of options as the modern enterprise must contend with a growing number of application locations - from on-premises and virtual, to SaaS or API-only delivery. But that is only one aspect of the matrix - as the consumable capabilities such as user storage, federation, signup or sign-in features must also be available both in a modular fashion and a range of integration options.

A key concern of feature integration is the ability to future-proof and have a clear roadmap of new requirements. Emerging technologies and challenges with respect to non-human identity (NHI) and agentic-access management are two of those new road map items. Firstly these areas are still relatively nascent compared to design patterns for areas such as credential reset or MFA enrolment. The standards associated with them are either immature or non-existent - so building from scratch will likely lead to rip-and-replace steps in the future.

An example of this is recent extensions to the Ory platform to support API key management requirements. AI is intrinsically reliant upon data and that data is integrated via APIs. Traditional approaches to API access often relied upon hardcoded and static credentials with broad scoped access. Even though that is known to be an anti-pattern, many deployments follow such characteristics, namely due to an inability to deliver repeatable and composable solutions across numerous platforms and deployments. An externalised approach to this challenge is how production platforms like Ory can support technology evolution but also improve developer productivity. Capabilities such as short lived tokens, decentralized and distributed approaches to capability management (ie the Google Macaroons design pattern) provide a much more strategic approach.

A second aspect of the need for future-proofing also relates to AI. The gateway model of coarse grained API protection has been readily adopted for AI-world. However, with any complex technology, a broad array of security controls are needed, as is a desire to implement fine grained protection. The recent emergence of the harness-design pattern sees the ability to apply lifecycle controls via a plugin-architecture to the core LLM platforms. Ory supports such a model with the ability to restrict not only access to certain tools to AI actors (for example the Bash shell) but also restrict commands being executed within the tool itself - to helping to prevent the dreaded “rm -rf” force delete command in *nix. The ability to provide agent security across LLM platforms such as ChatGTP OpenAI or Anthropic’s Claude consistently is where a platform like Ory helps - with a range of npms:

• Claude Code — @ory/claude-code

• Gemini CLI — @ory/gemini-cli

• OpenAI Codex — @ory/codex

• OpenClaw — @ory/openclaw

• OpenCode —@ory/opencode

Benefits for Builders and Business

• Lets Builders Build Apps

• Lets the Business Grow

A final comment on benefits. IAM is becoming more complex than ever before. We have more identities, systems and requirements to support - across a more varied deployment ecosystem. As IAM becomes more measurable and impactful for areas such as revenue generation, usability and developer productivity, a production platform essentially allows app owners and builders to do what they do best: build systems and deliver value. Externalisation of many IAM functions has been happening over the past two decades, but we now see maturity across many capabilities that can be deployed in a modular and composable design pattern. Platforms like Ory are now seen as enablers for the builders on top of them, not merely libraries and SDKs.

A more fundamental aspect, is that if builders are building more effectively and efficiently, the business by design becomes more adept at responding to change (be that external competitive pressure or compliance) and in turn can deliver more personalised experiences and revenue.

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut - a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

Book Inquiry Call

We are facing a market failure in trust. Period. The past decade organisations have been racing towards adopting a zero-trust approach to network access - yet…

Read more

Mythos was not the first LLM to be used for vulnerability discovery (and exploitation) and both red and blue teamers have done this for the past 3 years using existing and competing models. The bad guys have too of course. I think what Mythos did was both amplify the ability and by using a restricted access process via Glasswing perhaps made the concept seem more alarming. Alarming it is though and introduces numerous pragmatic and strategic issues with respect to how we detect, design and respond to risk.

From an identity point of view, we already have numerous issues to deal with: more identities, more types of identities, more systems and more attacks. Coupled with hybrid deployments organisations face an ever growing number of blind spots to identify and integration pathways to protect.

The litany of existing vulnerabilities across our identity landscape is both increasing and having a greater impact on both risk and productivity.

As the inter-relation between identity types grows (think B2E and agentic, agentic and agentic, agentic to B2C etc) so too does the cascade of risk across operational boundaries. Excess permissions for an employee, married to behaviour visibility issues coupled with long lived creds and intent drift for an agent results in an almost exponential level of concern.

So to that end, we have seen an ever growing focus upon identity security - the overlay model that helps to detect and protect across the often poorly integrated pillars of identity and access management capability. This overlay focuses upon both data and runtime concerns - looking at excess permissions, session misuse, cross-application behaviour and runtime control.

How can this identity security stuff be measured? The Cyber Hut took a holistic approach to this back in 2024 when we launched our Identity Security Scorecard concept. The main idea behind this was conceived from numerous buy-side workshops and architecture analysis sessions where I introduced several exercises to help organisations understand both their strengths and weaknesses with respect to discovering, protecting and detecting security drift across their entire identity worlds.

Ultimately though, we’re trying to “disrupt” the identity attackers flow. Clearly we also want to do this before their attack plans have completed. Can we detect, perform some sort of interceptive control and return the business back to a normal running state but with enhanced security?

We still need to do this. But now of course, we need to also consider how AI-centric attacks are accelerating the exploitation of existing vulnerabilities across the entire end to end life cycle of identities - for people, NHIs and agents.

That will include attacks against:

• Identity verification and on-boarding flows

• Profile directories and databases without integrity protection

• Credentials and MFA bypass

• Session issuance, verification and binding functions

• Reset and recovery flows

• The chaining of vulnerabilities

• Administrative interfaces, APIs and CLIs

In The Cyber Hut’s next industry webinar these topics will be the main focus. I will be sitting down with Roy Akerman and Rob Ainscough from Silverfort for a webinar entitled “Runtime Identity Security: The Winning Move Against Frontier AI Attacks”

We’ll discuss:

1. What AI-powered attacks are and how they break traditional security assumptions

2. The identity gaps attackers will exploit first across your environment

3. Security controls that can help

4. How to enforce Identity Security at runtime

Register for Live or On Demand

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut - a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

Permiso Security have brought up the point that agents need more than just posture management to make them secure. They articulate that guardrai…

Read more

Cisco this week announced they are to acquire NHI startup Astrix Security. Traditional security models focus on human users, but modern systems rely heavily on AI agen…

Read more

The 2-day event attracted over 2500 attendees and a strong vendor sponsor list - from large established players to more niche startups, along with numerous systems integrators and consultancies.

Where Is IAM Heading?

I opened day 1 with a presentation entitled “A Dynamic World Needs Dynamic IAM: Where Are We Heading?” - and provided a look into the main research areas we have seen at The Cyber Hut over the past 12 months.

As identity and access management has moved from being a tactical and responsive part of the internal workforce infrastructure, to a strategic enabler that improves productivity, drives revenue and online experiences for B2C ecosystems and integrates with a broad array of cyber security technologies, it has become a major attack vector for adversarial activity. Many would argue it has become the attack vector.

Complex and fragmented infrastructure combined with a highly evolving black market for attack tooling (potentially coupled with AI-based vulnerability exploitation platforms) has lead to a huge spike in identity related risk. That risk is focused at both the identity data layer and post-auth runtime layer too.

To that end we have seen a new set of technology areas emerge since 2022 that look to improve the security and risk posture of the entire IAM infrastructure world.

At the identity data layer (and with respect to identity data I mainly refer to profiles, policies and permissions) we see a slew of acronyms from IVIP (identity visibility and intelligence platforms), ISPM (identity security posture management) and further expansion of IGA (identity governance and administration) that leads into application governance and AI-governance.

A Future Guide to Identity Security

Available globally on Amazon, in Kindle, paperback and hardback

Order Now on Amazon

The strategic focus here is to essentially augment our access request and access review processing with more context - leveraging data sources that already exist within the modern enterprise - and make our decision making smarter. AI is accelerating this decision making too and we’re seeing a range of use cases that improve integration, permissions analysis and policy removal as a result.

From a runtime point of view, we’re seeing numerous initiatives here - including ITDR (identity threat detection and response) and many subtle sub-classes of behaviour analysis. The focus is understanding the intent of an identity - not just making sure they have the correct permissions. This will involve analysing usage and comparing behaviour across-applications. This often requires composite-risk analysis engines - taking into consideration several signals to help triangulate risk and trigger a responsive action.

Understanding when to act is often as difficult as deciding what to do as a response. The response aspect is also evolving and will require more than just a simple allow/deny choice. Disrupting, degrading, redirecting and more subtle response measures are now common - and especially in the external B2C space and aim to deliver security AND usability simultaneously.

A more strategic view of course is not just how to handle the data and runtime aspects of identity risk but do so across ALL identity types. We’re seeing innovation within IGA, ISPM and PAM with the increased usage of generative and agentic AI to improve decision making - alongside expansions into the non-human governance space too.

Ultimately both identity data and behaviour monitoring needs to support non-human, workloads, and agentic-AI as well as both B2E and B2C identity types.

Further Resources on Identity Data Risk

IAM for AI and AI for IAM

Every cyber or IAM conference in 2026 is going to have a heavy focus on AI - either to accelerate IAM adoption or in attempt to secure parts of the AI ecosystem.

Okta started day 1 with a generic focus on how both the LLM and agentic are firstly different components, but also have different control requirements. They articulated that a focus on the “information flows” between assets is a more strategic approach alongside a central plane that looks at both the identity creation flows and the runtime interception and enforcement of permissions.

Sailpoint extended the AI focus, with a need to provide IGA and life cycle management features for non-human identities as well as humans. A key first-principle to that model is to assign owners to agents, workloads and NHIs. This needs to be done for both existing live identities (that are essentially orphaned) as well as imposing sponsors during identity creation time.

Later in the morning, an Okta hosted a panel with ySec and TecPar that looked at AI from a more security exploitation standpoint. The rise of deepfakes, the increased speed of attacks and the ability to craft attacks in a “no-code” way has essentially given the attackers the advantage - for the time being. To that end, AI can be used to help discover the landscape first - what identities exist, where they are stored and what they are permitted to do. It really becomes essential to move from a reactive security standpoint to one that is more pro-active.

eTrust articled that AI is really in its “toddler” years - and emphasised again that using a sponsor and ownership is key to governance (take a look here at our recent Agentic Ownership guide).

Thales - the long time authentication specialists - amplified the story that AI is accelerating login based attacks. From improvements to how attackers can craft phishing emails. Later in the day they also presented a case study where they show how an authentication assessment (internal and external identities versus high and low risk) can help to identify future authentication modality requirements.

Platform providers CoffeeBean discussed how the combination of identity orchestration alongside AI is the strategic way to manage workforce IAM. As B2E has evolved, organisations need to integrate IAM into more systems, consume different data points and be more modular and fine grained with how IAM capabilities are deployed. The integration of logs and activity data can provide a continuous feedback loop into policies and controls. The key is augment existing pillars of IAM capability to improve coverage and usability.

Day 2 saw a panel hosted by NetBR that included practitioners from Itaú Unibanco and Bradesco that discussed how AI can help with IAM but also the controls needed to secure it. From an IAM point of view, access request, IDV analysis and account take over (ATO) protection were prime uses of emerging AI capabilities. The panel also observed how AI adoption is amplifying the need for data protection and how the concepts of external authorization platforms and policy based access control (PBAC) are key parts of that journey.

Identity for Security and Security for Identity

There are very few cyber security technology sectors (think XDR, data, mobile, cloud, network) that don’t either relying hugely on IAM working effectively (which is rarely does) or expect bi-directional integrations for data and runtime tokens and decision making. To that end, there were numerous talks amplifying the security angle of identity - either to protect the IAM infrastructure and its components, as well as the identities, accounts and usage of those components.

Sec4U on day 1 introduced the concept of the “identity attack surface” and how it is increasing. As organisational maturity gravitates to an all-digital approach for staff, customers, services and products, the level of risk increases. As a result, IAM strategy needs to move away from standard joiner-mover-leaver concepts and focus on being continual, continuous and contextual.

A practitioner panel from the airline manufacturer Embraer discussed how security considerations such as intellectual property protection are driving their IAM design. Insider threat, external attacks and complex supply chains can increase risk through visibility blind-spots and a lack of full coverage IGA capabilities. An increased focus on IAM process automation not only reduces error and human effort, it can also allow the organisation to become more risk adverse, by having confidence in the underlying processes. That then allows Embraer to move faster, collaborate and be more competitive. Some tactical comments also emerged, from the need to migrate to just in time (JiT) access to making sure IAM can fully integrate into the security operations centre (SoC) for analysis and investigations.

ManageEngine gave a talk looking at the huge rise in shadow identity - the impact of that and what can be done to tackle it. Whilst traditionally AD-centric, they articulated a broader strategy to improve both IT-security controls adoption and cleanup of the core identity data landscape.

The end of day 1 saw Prove discuss not just security of IAM, but more the privacy of identity data components. The attributes that make up a profile (especially in the B2C space) can be abused as part of identity verification, fraud and PII theft. They articulated the multi-source issue of how identity attributes can be leaked - and in turn used to create synthetic or blended identities that are then used for future attacks and data theft. These false identities can also be used in disinformation campaigns and influence operations that are proliferating into concerns such as election interference. Their solution is provide an identity-graph model that can continuously check identity attribute location and usage, verifying usage, integrity and historical assurance.

B2C CIAM Design Fundamentals

Available globally on Amazon, in paperback and Kindle.

Buy now on Amazon

Day 2 saw Banco Bradesco (the third largest bank by assets in Brazil) discuss a case study. Some interesting aspects included the need to future proof against emerging security threats - such as post-quantum readiness and protection against the rise of deepfakes. Identity and security in general is a process not a product and they have developed modular approach to both designing, implementing and deploying IAM components for staff, customers and non-human identities, with composable features for authentication and authorization.

Further Insight and Whitepapers

Raise IT (a partner of Transmit Security) discussed the security and fraud components that are emerging within the B2C CIAM space. Fraud is no longer just attacking the account creation and on-boarding phases, but must be handled end to end at all parts of the B2C life cycle. With the advent of agentic-AI within the B2C world, a transaction signing lineage must be considered that can provide assurance and integrity protection for transactions.

JumpCloud gave a novel description of how device analysis and mobile device management (MDM) systems have evolved into more generic endpoint protection platforms - and must be more closely linked into the privilege access management flows. They argued that identity on its own cannot live in a vacuum and the originating device must be considered during authentication and authorization enforcement checks. Hexnode delivered a similar message later in the day, with their solution offering a broad array of mobile and device integration options in order to strengthen the coverage for device security.

Later on day 2, Silverfort argued that original joiner-mover-leaver processes were not built for security - they were built for productivity and compliance. As organisations move towards a more hybrid deployment model, visibility and control of identity usage becomes a vulnerability. Their view of identity security involves a “runtime access protection RAP” component that can augment and extend Active Directory authentication and access with a range of behaviour and threat detection capabilities.

Recent Industry Interviews

Final Comment

IAM Tech Day is one of the premier identity events globally, not just for LATAM. The core themes of AI and identity security amplified what is happening in North America, EMEA and APAC too.

As IAM becomes a strategic enabler for technology transformation, business productivity and revenue generation, the security and privacy aspects become critical.

How we measure and deploy IAM services is changing massively. Several talks (including those by Shield Security, Sec4U and NetBR) all showcased modern and strategic approaches of how to embed IAM within the C-level talk track. From improved communications and metrics to how to find and in turn manage risk. IAM strategies and tactics need to be co-authored with a broad array of stakeholders. The use of natural language processing as the standard user experience (UX) of choice can open up previously complex IAM policy components to non-technical leaders who can both consume performance data, but also contribute to the overall management of the IAM world.

It becomes critical to work in a top-down model - identifying business and team objectives before identifying the data, cyber and identity components that help or hinder those plans. What does MFA really do for the business? How can just in time access help their partners or customers? These lower level controls must be translated and presented in a way that matters to the key budget holders.

If organisations can achieve that, their future identity strategy will both enable security but also improve usability.

Saúde!

Vendor and Integrator Shout Outs

Authcube - Orchestrate and protect identities in one unique platform what unite security and experience

CoffeeBean Technology - Orchestration in IAM refers to the automated coordination of identity and access management processes across systems, applications, and security tools.

eTrust Security - We are cyber security. We are identity.

JumpCloud - Securely manage devices and access for all human, non-human, and agentic identities.

NetBR - We are an extension of your company, generating knowledge through interaction with your teams , delivering greater value to your identity program.

Prove - Prove transforms identity from a one-time verification event into a persistent foundation of trust-built to verify every person, business, and AI agent, at every interaction.

Sec4U - Your security doesn't have to be complex! Protect your workforce and digital customers without impacting your business flows and usability.

Shield Security - Shield Security has a broad portfolio of services associated with the best manufacturers on the market. The goal is to offer excellent service, seeking to understand the needs of each client for a personalized delivery.

Silverfort - Discover and protect every dimension of identity, everywhere. Human, machine or AI, cloud or on-prem—including systems that couldn’t be protected befor

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut – a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

Book 90 Minute Discussion Workshop

That separation is increasingly becoming a problem.

The Challenge of Fragmented Access

When physical and digital access are handled in silos, organizations struggle with:

• Inconsistent policies across systems

• Gaps in security, especially during onboarding and offboarding

• Limited visibility into who has access to what

• Operational inefficiencies from duplicated processes

For example, an employee may lose system access immediately after leaving—but still retain access to a building. These disconnects introduce risk and complexity.

A Shift Toward Unified Access

To address this, organizations are moving toward a unified design model, where identity becomes the central control point for all types of access.

In this approach:

• A single identity governs access to both physical and digital resources

• Policies are applied consistently across environments

• Access decisions are centralized and context-aware

This represents a shift from system-centric security to identity-centric security.

As organizations continue to digitize and expand, managing access in silos is no longer sustainable. A unified, identity-centric approach provides stronger security, better efficiency, and a more seamless user experience—bringing together the physical and digital worlds under a single access strategy.

I wrote about this concept in more detail in a recent analyst opinion piece written for HID.

Read Full Article

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut — a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

In early 2025 The Cyber Hut released a discussion-focused article on the “Laws of Identity Security”. The idea behind this was to create interest around what identity security is and how we can start to pragmatically approach the security controls and architectural design stages.

Law 3 in that series was: “Every digital identity (human and non-human) must resolve to a carbon physical person who is accountable for it”.

As AI agents proliferate — often outnumbering human identities by 50:1 or more — the ability to trace every agent back to a responsible human owner is foundational to governance, incident response, compliance, and risk management. Without it, organisations face ‘ghost agents’ with active privileges and no accountability.

Agents need accountability yes, but they also need to be strategically managed as part of a life cycle. That life cycle in turn needs to be linked to a human life cycle for completeness.

The Why

The human B2E employee life cycle can be quite well defined. A basic Google search (or other) will likely generate something like the following:

• Joiner (Onboarding)

  • Creation of the digital identity from an authoritative source (HR system)

  • Account creation + initial access provisioning

  • Often automated for Day 1 readiness

• Identity Proofing & Verification

  • Ensuring the person is who they claim to be

  • Background checks, document validation, etc. (more critical in high-assurance roles)

• Authentication Setup

  • Credential issuance (passwords, MFA, passkeys)

  • Binding user to authentication methods/devices

• Authorization / Access Provisioning

  • Assigning roles, groups, entitlements

  • Based on RBAC/ABAC policies (least privilege principle)

• Access Request & Approval

  • Ongoing process where users request additional access

  • Workflow-driven approvals (manager, app owner, etc.)

• Access Review & Certification

  • Periodic audits of user access (compliance-driven)

  • Managers/app owners validate “who still needs what”

• Mover (Role Change / Lifecycle Update)

  • Adjusting access when a user changes role, department, or project

  • Prevents privilege creep

• Leaver (Offboarding / Deprovisioning)

  • Timely removal of access when a user leaves

  • Includes account disablement, session termination, and cleanup

Now clearly, each of those stages will also have sub-life cycles too. Especially for things like credential management and and issuance. Of course, many organisations struggle to automate these components and are faced with issues such as:

• Orphan accounts - no longer linked to a real identity

• Ghost accounts - never linked to a real identity

• Excess Permissions - assigned versus used out of sync

So what? Well we now need to consider an equivalent agentic life cycle - even if that world is relatively new in comparison.

An example life cycle model for agents could look something like the following:

The management of the agentic life cycle is going to require some different approaches and likely tooling to that of the human world. That is out of scope for this cheat sheet however.

What becomes clear though, is that we need to link the agentic life cycle with the human one. Agents do not and cannot live in a vacuum.

Capabilities

We are now presented with several issues:

1. How to find an owner for agents already live that are orphaned

2. How to assign ownership during agent creation in a way that doesn’t inhibit development

3. How to enforce life cycle changes for humans and agents together

A few ways seem to exist with respect to how this could be done.

• AI/ML correlation — analyses logs, code commits, device telemetry, or behavioural signals to infer the likely human owner.

• Blended/delegated identity — binds the human’s IdP token to the agent at session initiation (e.g. OAuth On-Behalf-Of flow).

• Manual/admin assignment — a human administrator explicitly designates an owner in the platform UI or via policy.

• Sponsor/succession model — a formal sponsor is required at creation; ownership auto-transfers if the sponsor leaves.

• Creation-time attribution — the identity of the creator/deployer is captured when the agent is registered or provisioned.

• HR/directory integration — ownership is inferred from organisational data (Active Directory, Okta, HR systems).

• Access review/certification campaigns — periodic campaigns prompt stakeholders to confirm or reassign ownership.

Not all methods are comparative of course and rely on different information sources and dependencies within the infrastructure.

There is also a subtle difference between live agents and future-created processes needed to assign an owner at creation time. The current state many organisations are likely to be in, is the former - facing discovery and inventory exercises for agents that are already live.

Let us know your approaches to this emerging problem:

Start Survey on Agentic Ownership

Market Considerations

1. Many vendors consider ownership as a secondary function - even if they provide the capability. Immediate focus is often on discovery, then authentication, authorization and permission management

2. Two dominant paradigms exist: proactive discovery vs. creation-time capture - the use of “live” data such as logs, telemetry are used as inference of ownership. Creation capture provides support for the longer-term governance model.

3. Sponsor model seems most compliant-ready - having a dedicated human sponsor used during agent creation (and in turn provides downstream changes if the human sponsor undergoes changes themselves) seems the most likely to support compliance interrogation.

4. Linking of human identity provider tokens to downstream agents can provide an end to end level of cryptographic traceability.

5. Post creation access review campaigns need context - reviewing existing agent permissions and “liveness” requirements really needs an owner to be identified first for them to be effective

Example Vendor Solutions for Agentic Ownership

There are numerous vendors delivering agentic identity solutions. A sample of those have capabilities with respect to ownership discovery and assignment.

Aembit

https://aembit.io/iam-for-agentic-ai/

Aembit uses a ‘Blended Identity’ model that cryptographically combines the AI agent’s non-human identity with the human user operating it at authentication time. It integrates with existing IdPs (Okta, Azure AD, Google) via OIDC/OAuth 2.1 so every access request carries verifiable human context. The human is not discovered post-hoc — they are bound into the access token at session initiation.

Andromeda Security

https://www.andromedasecurity.com/use-case/agentic-ai

Andromeda explicitly offers a ‘Human Ownership and Governance’ capability. It identifies and certifies human owners for each discovered agent, runs ownership and access review campaigns, and enforces least privilege based on confirmed ownership. The platform maintains a centralised inventory mapping agents to humans and supports ongoing certification cycles.

Clutch Security

https://www.clutch.security/use-cases/workforce-attribution

Clutch has a dedicated ‘Workforce Attribution’ use case that reveals every human-NHI relationship — creator, owner, user, or value exposer — for the full NHI estate including AI agents. Its Identity Lineage™ feature aggregates and correlates data from Cloud, SaaS, Code/CI-CD, Vaults, and on-prem environments to build a visual map of origin, consumers, attribution to the workforce (owners/creators), storage, and resources. Shadow AI Discovery surfaces unmanaged agents, and the Agentic AI Governance module controls how agents use and share NHIs.

Entro Security

https://entro.security/platform-ai-agents/

Entro automatically correlates agent activity with human users through logs, code commits, and device telemetry, then enforces ownership via policies, alerts, and automation. Its AGA module uses three data layers — Sources (EDR telemetry, agent foundries like AWS Bedrock/Copilot Studio, cloud environments, MCP servers), Targets (enterprise systems the agent touches), and Identities (human/NHI/secrets) — to build a complete agent profile and attribute each agent to a creator/owner. Ownership is then enforced through access review campaigns aligned with IGA principles.

Microsoft Entra (Agent ID)

https://www.microsoft.com/en-gb/security/business/identity-access/microsoft-entra-agent-id

Microsoft Entra Agent ID (in public preview) introduces a formal ‘Sponsor’ model: every agent identity must have one or more human sponsors, who are accountable for its lifecycle and access decisions. Sponsors are assigned at creation or via the admin centre. If a sponsor leaves the organisation, their sponsorship is automatically transferred to their manager via lifecycle workflows, ensuring no agent becomes ownerless. Access packages requiring sponsor approval enforce human accountability at each access request. The Agent Identity Blueprint also records publisher, roles, and permissions at the type level. Both attended (on-behalf-of OAuth OBO flow, tying the agent to an authenticated human) and unattended (autonomous) modes are supported.

Oasis Security

https://www.oasis.security/product#ownership

The Oasis NHI Ownership Discovery Engine uses purpose-built AI/ML algorithms to suggest and assign owners by analysing the digital footprint and behaviours of those who consume NHIs — without requiring pre-existing metadata, tags, or naming conventions. Its AAM™ product tracks a full chain of custody: Human → Agent → Prompt → Intent → Policy → Identity → Actions → Results. Ownership recommendations are automated and then attested by security teams. The platform also covers ownership succession and flags orphaned agents when creators leave.

SailPoint

https://www.sailpoint.com/products/agent-identity-security

SailPoint’s Agent Identity Security (AIS) product formally certifies AI agents by assigning clear human owner and user accountability, enforcing permissions, and linking agents to the identity context of the users they represent and the data they access. Owners are aggregated from cloud and agent platforms (AWS, Azure, GCP, Salesforce, Copilot Studio) and can have multiple owners per agent. Ownership data is maintained for audit and succession planning — when an owner changes roles or leaves, ownership is quickly reassigned without losing visibility. SailPoint’s unified platform governs human, machine, and agent identities together, enabling consistent access review certifications across all identity types.

Saviynt

https://saviynt.com/blog/ai-agent-lifecycle-management

Saviynt’s view is that if registration establishes the identity, ownership establishes accountability—and without it, governance collapses into ambiguity. Every AI agent must have a named, accountable owner from day one, and that ownership must persist and be enforced throughout its lifecycle. AI agents do not belong to systems; they belong to a human sponsor, a team, and a defined business purpose. This means a specific individual—not a shared mailbox—is responsible for the agent’s behaviour, access, and compliance, with clear alignment to business and executive oversight.

Saviynt identifies owners by leveraging authoritative sources such as HR systems and identity directories to map agents and accounts to real individuals and reporting structures. It correlates access patterns, entitlement usage, and system relationships to infer likely ownership where it is not explicitly defined. These inferred owners are then validated through governance workflows, such as certification campaigns and attestation, to establish and confirm accountability.

Token Security

https://www.token.security/use-cases/establish-ai-agent-ownership-and-accountability

Token Security has a dedicated ‘Establish AI Agent Ownership and Accountability’ use case. It automatically discovers every AI agent (custom GPTs, autonomous services, MCP servers, coding agents) and assigns clear human and departmental ownership to each. Orphaned agents — those without a responsible owner or linked to a departed employee — are flagged, and ownership assignment is enforced. Token’s unified identity graph correlates AI agents, humans, secrets, permissions, and data to reveal blast radius. Intent-based controls (declared and observed agent intent) further align permissions to agent purpose.

Twine Security

https://www.twinesecurity.com/use-cases/account-ownership-integrity

Twine’s AI employee ‘Alex’ specifically identifies orphaned accounts — users/agents that have access but no valid owner — investigates which employee should be responsible for each account, and updates the record with the correct owner. This is an active investigation workflow rather than passive metadata correlation. Alex integrates with existing IGA platforms and improves the efficiency of access certification by providing richer context to managers during reviews.

Other Vendors of Note

Anetac, Astrix Security, Eqty Lab, Knostic AI, Radiant Logic, SecureAuth, Sonrai Security, Teleport

Recommendations

• For shadow AI / legacy environments (no existing metadata): Prioritise vendors with AI/ML-based correlation approaches.

• For Microsoft-centric organisations: Microsoft Entra Agent ID provides the deepest native integration with existing Entra governance tooling and the most formally specified ownership succession model.

• For organisations prioritising cryptographic accountability look to see if vendors support the ability for per-session linking of human tokens to agent access materials.

• For organisations with mature IGA programmes look to see if existing access governance can be built upon a foundation of linking agents to human reviewers via additional context

About The Author

Simon Moffatt has over 25 years of experience in IAM, cyber, and identity security. He is the founder of The Cyber Hut, a specialist research and advisory firm based out of the UK. He is the author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker, and a strategic advisor to entities in the public and private sectors.

Book Consultation to Discuss

Share The Cyber Hut Radar - Emerging Technology Research

Last updated 16 April 2026

Anthropic recently announced something called Project Glasswing. A partnership with leading technology vendors to improve cyber security. Organisations such as Microsoft, Palo Alto, Nv…

Read more

I have personally being going to RSAC for over 15 years, and this was the 5th consecutive year of taking The Cyber Hut there as an analyst firm.

Even in that relatively short half-decade, technology, world events and business needs have iterated hugely - often going through the entire invention-innovation-obsolescence cycle. I think the biggest contribution AI is currently making, is the significant reduction in time that cycle is taking to complete - which in turn is driving further adoption of AI, but also making the measurable impact more tangible.

Show Floor Splashes

Let’s be clear, if your vendor booth wasn’t “securing AI”, “discovering agents”, “being the AI control plane” your marketing team wasn’t on point. The fascinating thing of course, is that many vendors claiming these capabilities were - 12 months ago - likely to be non-competitive with one another. What does that tell us?

Firstly there is a lot of froth and marketing fluff emerging from many vendors as it pertains to AI security. Secondly, many of the topics that numerous small and emerging technology vendors were trying to solve 12-18 months ago were clearly not attacking the correct problem statements.

Of course, there are many vendors who are developing some series capabilities to secure the AI world. But not all AI is the same. Firstly AI is hugely broad and equally it will take a “village” to secure both the end to end usage of AI - including the building blocks such as agents, MCP, models and tools - as well as the most critical aspect of all: the thing which makes AI tick, is of course data.

So by association it is quite legitimate to see so many vendors from a broad ecosystem of security to be promoting and gravitating to the AI world. No one single vendor or even platform will be able to handle this complexity today. And I suffix “today” to that statement as things may well change - as a result of the use of AI to the extent that consolidation, feature innovation and understanding, may well allow multiple aspects of the AI world to be secured from a single source.

But we need to first understand AI:

• has lots of moving parts

• interacts with humans - remember those?

• should be designed with higher level objectives in mind

• will be influenced by external factors such as ethics and compliance

So the show floor was dominated by AI - from the data, identity, endpoint and operations worlds. These are big broad buckets for sure, but these pillars have many existing concepts that can be applied to the AI world. A few interesting questions and use cases though I feel are not necessarily getting the attention they deserve.

We also need to consider:

• How AI links to human actions, ownership and risk

• Who or what can access an agent - not just what the agent can do

• How to manage the AI-mesh

This AI-mesh concept is emerging more and more with the B2C identity world. Typically the modus-operandi for B2C identity is for the service provider to try and deliver personalised experiences for an end user - and in turn be a position to engage more and sell more. To do this of course the service provider requires data - which brings in a privacy conflict (see CIAM Design Fundamentals for why this occurs and how it can solved) and a primary need to “own the user identity”.

The introduction of agentic AI can potentially create a barrier between a service provider and a consumer or purchaser of a service. This was discussed in detail on episode 70 of The Analyst Brief podcast and it will be interesting to see if this does materialise into a real issue.

I guess the AI-mesh may ultimately end up to be a “robot wars” style evolution - with agent to agent being the standard interaction model, which in turn is a race to the bottom with respect to having only AI being the apparatus that can truly interact with and ultimately secure other AI components.

From the show floor, the immediate capabilities that have emerged into relatively stable value points:

1. Discovery - being able to rapidly find AI components - be that agents running, shadow AI services being used and MCP services deployed

2. JiT - being able to at least design a just in time access model for agents, so they only have the access they need for a very short period of time

3. Behaviour - being able to monitor agent behaviour to identify malicious intent, changes in usage or optimization steps that look dangerous or damaging

4. Ownership - whilst acknowledged as being vitally important, the approach and consistency here for linking agents to carbon life forms is lacking a little

The Cyber Hut Recent AI Research

Topical Talks

Whilst most of my time was in vendor briefings and show floor hopping I did manage to get some live session action in - and as always I tried to select a broad cross-section of topics.

Star Dot Typhoon

My first session, was literally the first talk of the week and a Day 1 0830 start to listen to Inside the Hunt for China’s Typhoons: Disrupt, Deter, and Defend. The “typhoon” campaigns have brought some considerable disruption to numerous private sector entities. These attacks are being attributed to Chinese nation state actions - but with some subtle nuances between Volt Typhoon and Salt Typhoon with respect to attribution, behaviours and more importantly defensive response.

If Salt Typhoon was focused more on espionage and knowledge collection, Volt Typhoon was being classified as “military pre-positioning” and unpicking the why with strong attribution in turn helps defensive actions be more focused.

This defensive response of course relies on threat intelligence sharing - and the link between public agencies and private enterprise and in turn between private enterprises (who may well be competitive in their respect sectors) has been brought up on numerous occasions, with no real solution to strategically improve this. The talk ended with a discussion on the “hack back” option - and whilst this may well be “off the table” with respect to recent US cyber strategy, it generated several audience questions around pro-actively defending core assets.

As an aside, the number one recommendation with respect to lessons learnt was of course identity-centric defense. Not only from an attribution point of (knowing who and what has strongly authenticated) but by analysing account behaviour, permissions usage and the like, can strongly help with intent analysis too.

Drones Need Identities Too

Another talk that caught my eye was entitled Beyond the Fence: Securing Our Skies from the Drone Threat. Whilst this may seem like an obvious candidate for both military and physical related security discussion, it was rapidly boiled down into a cyber and more specifically an identity related issue. Whilst the threat vector has moved from being 2D to 3D - the digital and logical side of drone management has become a major issue.

The rise of anonymous drone activity across many US cities in recent years has sky rocketed - with a lack of both drone identifier information but also lineage of drones to physical people. Sound familiar? It’s exactly the same conceptual use case for both non-human identity and agentic usage today. First discover all instances, then remove anonymous entities and then apply risk analysis functions.

There is a basic “remote ID” concept but lacks integrity protection, is optional and also doesn’t necessarily contain information relating to the physical owner. It would seem the most sensible option to bind the drone to an owner on purchase. Likely via a mobile app with strong MFA. There are numerous existing standards here that could help - from FIDO for authn, but also OAuth2 Device Authorization grant perhaps too - allowing the drone to “act on a user’s behalf”. Preventing the drone from powering on until an owner had been authenticated may not fly (pun intended) commercially but seems like the most sensible way of improving lineage and trust.

Venture Capital + AI = Market Transformation?

One of the first sessions on the final day brought not only coffee requirements but some insight from the VC and investment world on how they are viewing the AI revolution: what might happen next, how they evaluate AI startups and what might happen to the existing incumbents.

The AI Gold Rush in Cybersecurity: Where Venture Dollars Go was a great panel and the amplification of a “gold rush” is so apt.

The concept of a trillion dollar cyber security company emerged and will AI make this possible? The industry pendulum moves consistently between best of breed and best of suite and will AI accelerate either of these end goals?

Some interesting points were made about how AI is impacting existing market trends - namely that feature implementation and code generation is increasing innovation. So platform providers can rapidly add new capabilities at the edge of their core competency - namely as building stuff now takes less time. That in turn has had a knock on with respect to merger activity. It will be interesting how long that continues for, but for sure, feature differences between organisations is becoming extremely narrow.

But having features alone is no longer enough. The “Balkanisation” of markets and the general anti-American global sentiment is what Dave DeWalt says will be one of the key issues in the coming period with respect to how to get to being a trillion dollar business. How can vendors aim to deliver global services to different geographic markets, with different compliance, sovereignty and supply chain constraints? Does AI help or hinder this?

They also brought up the interesting maturity of companies such as Salesforce, ServiceNow and Mastercard who now have significant cyber security offerings when historically that has not been their core aim. Will this trend continue, with essentially ever organisations providing cyber capabilities at some level?

Midnight at the War Room

The final talk I caught, was literally one of the final sessions on the final day. A distinguished panel of Chase Cunningham (Dr Zero Trust), Sarah Gosler, former Deputy Director of the NSA Chris Inglis and RSAC exec and cyber luminary Jen Easterley dived into the world of cyber warfare.

The panel was supporting and showcasing clips of an up and coming documentary called “Midnight in the War Room” being developed by Semperis. The full documentary will be released in August at Blackhat USA but the panel gave some interesting glimpses into what cyber war in 2026 really means, how it’s evolving and what can be done to respond to it.

The most headline catching line was likely delivered by Chase, articulating that “if your dog is wearing an Internet-enabled dog collar, it’s part of the battle field!”. Meaning that we are now entering an age where digital and cyber warfare is real - and the private sector has become the 6th domain of war fare after land, air, sea, space and cyber.

Innovation Sandbox

The annual innovation sandbox is a chance for early stage cyber vendors to pitch in front of both an esteemed panel put together by RSAC as well as a few hundred audience members. Each vendor gets exactly 3 minutes to pitch their idea, vision and strategy before being grilled by the panel. An hour or so deliberation results in a winner - with funding and glory - with each of the 10 finalists receiving a healthy $5 Million to boost their growth.

The winner of the accolade of “most innovative startup 2026” went to Geordie AI with their AI governance platform. An end to end view of usage as well as linkage to human ownership were core mentions. They describe themselves as “Geordie gives your organization a holistic, real-time understanding of its agentic footprint, whether agents are locally coded, self or SaaS hosted, or built on low or no-code platforms. Geordie combines behavioral observability and posture context to build a living picture of how agents operate.”.

Numerous startups during the week talked the same talk. Time will tell which wins out.

Other participants included:

• ZeroPath - looking to improve app sec scaling

• Token Security - improving identity security for NHI and agents

• Realm Labs - detection and response for AI with a deep neural scanner

• Humanix - improving social engineering detection and response

• Glide Identity - reducing login phishing with SIM authentication

• Fig - security operations optimization

• Crash Override - becoming the control for software development life cycle

• Clearly AI - compliance, data and privacy security analyser and assessment

• Charm Security - scam and fraud prevention platform using agents

Early Stage Standouts

In addition to both the Innovation Sandbox and the main vendor show floor expo, there is the Early Stage Expo - which is essentially a combination of the two. Around 80 vendors - some entirely new, some with a bit of funding and a year or two in the market - exhibit and engage in prospect discussion. A few that caught my attention from an identity point of view:

• 12 Port Inc - looking to reinvigorate the privileged access space

• Identity Rules - a Mexico based ITDR and identity behaviour startup

• Klyro - IGA focused helping to accelerate application onboarding

• WideField Security - visibility and behaviour monitoring

• Hush Security - NHI and machine security platform

Vendor Briefing Shout Outs

A quick shout out to vendors who I met with more formally to discuss their product, sales and technical go to market updates. It is always exciting to get updates from so many smart and innovative leaders, passionate to help solve some of today’s most pressing identity and cyber security problems. Over the week I spoke with:

• Andromeda Security - “Intelligently discover, secure, and govern AI agents, humans, and NHIs—driven by risk and behavioral context.”

• AppViewX - “Automate certificate management and PKI. Govern agentic and machine IAM. AppViewX secures enterprises for the AI and quantum era.”

• Axiad - “Trusted Identity. At the speed of now.”

• Cy4Data Labs - “Unlimited Encryption Keys. Unbreakable Security. Zero Performance Impact.”

• Britive - “We don’t manage standing privileges. We eliminate them. One control plane, one policy, every identity.”

• Cisco - “Leverage intel from across your stack to enforce policy, manage endpoints and deliver trusted access. Multi-cloud NAC with zero trust makes it possible.”

• Delinea - “Redefining identity security for the agentic AI era”

• Descope - “Reduce user friction, prevent account takeover, and get a 360° view of your customer and agentic identities with the Descope External IAM platform.”

• Entro Security - “Unified identity security and lifecycle across Non-Humans, AI Agents & Humans”

• ManageEngine - “Secure and manage enterprise digital identities and
  privileged access.”

• P0 Security - “The P0 AuthZ Control Plane™ makes production access fast, secure and easy to manage. No standing privilege, no manual overhead, no audit surprises.”

• Pathlock - “When traditional IGA isn’t enough, companies turn to Pathlock for compliant provisioning, fine-grained SoD analysis, user access reviews, privileged access, and continuous controls monitoring.”

• Permiso - “Discover.Protect. Defend. Monitor All Identities In All Environments. Redefining identity security for the agentic AI era”

• PlainID - “Agentic AI changes everything, Run-time Authorization makes it secure.”

• pQCee - “Be Quantum Ready. Start your quantum readiness journey early”

• Unosecur - “Discover, govern, and enforce least privilege for every AI agent, NHI and human identity across multi-cloud, SaaS, IdPs, and on-prem in run-time.”

• Crowdstrike/SGNL - “SGNL sits at the center of your IAM architecture. It eliminates standing privilege and instantly adapts access when conditions change.”

• Silverfort - “Discover and protect every dimension of identity, everywhere. Human, machine or AI, cloud or on-prem—including systems that couldn't be protected before.”

• Teleport - “Teleport unifies identities — humans, machines, and AI — with strong identity implementation to speed up engineering, improve resiliency against identity-based attacks, and control AI in production infrastructure.”

• Zluri - “Gain complete visibility into identities and access, automate governance, and continuously manage identity risk across your enterprise.”

Pick of the Parties

And finally…RSAC wouldn’t be RSAC without some legendary parties. Whilst the jeg lag inevitably kicked in, I did manage to float across the evenings to continue the networking, grab a beer and even on one night - shock horror - get away from RSAC entirely and see one of my favourite musicians, the iconic Johnny Marr former guitarist of The Smiths at the fantastic small venue the Great American Music Hall.

A few specific shout outs should be raised. Wednesday I attended the Security Founders' Oasis at the great Chinese restaurant Fang hosted by Leen, Ross Haleliuk (Venture in Security), Caleb Sima (White Rabbit VC), Cimento AI and Paul Lanzi (IDenovate). Really packed party with a broad selection of startups and founder leaders.

Monday I got to attend someone else’s podcast (instead of host The Analyst Brief) for a change and watched a live recording of the Silicon Zombies record an episode called 'The Art of the Possible in Cyber-security' with experts from Acalvio Technologies and accuknox over at the Embacadero Center.

The final night on Wednesday I headed down to Yerba Buena bar for The Hive Reception hosted by Bugcrowd, HPE Networking, Menlo Security, and Unosecur - which should get the marks for the best craft beer during RSAC with a great Drakes Hazy IPA on draught.

After that was the Insight Partners ScaleUp party on Minna sponsored by Veeam, Teleport, Island and Delinea amongst others.

One final party shout out should really go to investors Thoma Bravo for hosting a great event at the Museum of Modern Art. A key highlight is yet another musical one, this time with Kings of Leon entertaining the cyber masses.

Final Comment

From a technology point of view AI dominated. There’s no question. From how it can be protected to how it can be used within cyber. There are clearly lots of unknowns and lots of moving parts, but the innovation cycles are collapsing rapidly. Feature implementation has accelerated hugely. But whilst the “how to build” may have become easier with vibe coding and faster integrations, the “what to build” can still be tough.

As that needs humans. And I think that was a key underlying theme throughout the entire week. Either being explicitly called out in several of the key notes - specifically about the power of the community within cyber - but also more subtly when trying to understand where AI is taking us.

We must not forget the human-aspect within AI and technology in general. How we will integrate and use technology, the benefits (and potential damage) it can bring to us and our actions as responsible and accountable people.

I guess this was brought to a funny pinnacle, with the actor Kevin Bacon (and this brother) encouraging a packed key note audience to become only one-degree away from a Bacon with a mass singalong. Let’s end it there.

Further Resources

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut – a specialist research and advisory firm based out of the UK. He is author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

Book an inquiry consultation to discuss any of the above vendors.

This fragmentation is no longer just inefficient—it is a fundamental business and security risk.

The Problem: Identity Fragmentation at Scale

Modern enterprises manage a rapidly expanding set of identities:

• employees and contractors

• service accounts and APIs

• cloud workloads and automation

• emerging AI agents

However, these identities are typically governed by multiple IAM systems operating in silos, often 6–16 different tools in a single organisation.

This creates a fragmented environment where:

• visibility is partial

• policies are inconsistently enforced

• identity relationships are poorly understood

The result is an incomplete and unreliable view of access and risk.

What Can Be Done: Migration to Unified Identity

The core need is for a unified identity model, often described as an “identity mesh.”

This approach connects all identity systems—legacy, cloud, SaaS—into a single, orchestrated layer.

Key characteristics include:

1. Centralised visibility

• A complete inventory of all identities (human and non-human)

• Clear mapping of permissions and relationships

2. Consistent policy enforcement

• Unified access controls across all environments

• Standardised authentication and governance

3. Continuous monitoring

• Real-time tracking of identity behaviour

• Detection of anomalies and misuse

4. Lifecycle orchestration

• Integrated joiner–mover–leaver processes

• Automated provisioning and deprovisioning

These concepts are part of an analyst comment series written for Unosecur. The first article is available to read now.

Read More

About The Author

Simon Moffatt has over 25 years of experience in IAM, cyber, and identity security. He is the founder of The Cyber Hut, a specialist research and advisory firm based out of the UK. He is the author of CIAM Design Fundamentals and IAM at 2035: A Future Guide to Identity Security. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker, and a strategic advisor to entities in the public and private sectors.

Yet despite these advances, many organisations still suffer from weak identity assurance. The reason is not a lack of technology, but a failure in how identity is experienced across the user journey, that merges the physical and digital realms.

The Problem: Fragmented Access & Authentication

Most organisations treat identity as a series of disconnected events:

• Enrolment (initial setup of credentials)

• Authentication (logging in)

• Recovery (password resets, account unlocks)

In practice, these stages are often handled by different systems, policies, and processes. This leads to:

• inconsistent user experiences

• duplicated credentials

• gaps in assurance between steps

If we then multiple this fragmentation across different systems and different scenarios across the physical and digital realms, we have a cascade of issues.

Why This Matters: Assurance Breaks at the Weakest Point

Identity assurance is only as strong as its weakest link. Even if authentication is robust, weaknesses in enrolment or recovery can undermine the entire system.

For example:

• Weak identity proofing during enrolment allows false identities

• Poor recovery processes enable account takeover

• Inconsistent policies create exploitable gaps

In a recent analyst comment article written for HID I emphasise that recovery and reset processes are often the least secure parts of the journey. If this in turn is amplified by isolated physical and digital integration this problem becomes one of high risk and poor user experience.

What Can Be Done: Shift From Authentication to Journeys

The key insight from the article is that identity should not be treated as isolated controls, but as a continuous, end-to-end journey.

This requires a move toward:

1. Converged identity

• A unified system across digital and physical access

• Single identity spanning enrolment, authentication, and recovery

2. Continuous assurance

• Identity confidence maintained over time, not just at login

• Contextual signals (device, behaviour, location) informing access

3. Seamless user experience

• Reduced friction through passwordless or adaptive authentication

• Consistent processes across all identity interactions

Read More

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut — a specialist research and advisory firm based out of the UK. He is author of Consumer Identity & Access Management: Design Fundamentals and “IAM at 2035: A Future Guide to Identity Security”. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

The Fragmentation Problem

In many organisation, authentication is fragmented across multiple systems, tools, and environments. Employees move between physical access (badges, PINs) and digital systems (passwords, MFA, SSO), each with different processes for enrollment, login, and credential reset.

The result? A disjointed and inconsistent experience that creates what can only be described as credential chaos.

More Friction, Less Security

This fragmentation doesn’t just frustrate users—it actively undermines security.

Users are forced to manage multiple credentials and workflows, leading to frequent resets, workarounds, and mistakes. At the same time, IT teams struggle with rising support costs and operational complexity.

Critically, organisations lose end-to-end visibility of identity. There’s no reliable way to ensure that the person who entered a building is the same one accessing sensitive systems later.

Identity Assurance Breaks Down

Identity assurance—the confidence that someone is truly who they claim to be—depends on consistency across the entire access journey. But when authentication is siloed and inconsistent, that assurance collapses.

Security controls become difficult to enforce, measure, and scale. Integration between systems becomes fragile. Costs increase while trust decreases.

The Case for Unified Authentication

By unifying authentication across physical and digital environments, organizations can create a single, consistent identity journey. This results in:

• One cohesive authentication experience

• Centralized visibility and control

• Stronger, measurable identity assurance

A unified approach not only improves security but also reduces friction and enables future scalability—especially as non-human identities continue to grow.

This is a topic I wrote about in more detail in a recent analyst comment made for HID.

Read More

About The Author

Simon Moffatt has over 25 years experience in IAM, cyber and identity security. He is founder of The Cyber Hut — a specialist research and advisory firm based out of the UK. He is author of Consumer Identity & Access Management: Design Fundamentals and “IAM at 2035: A Future Guide to Identity Security”. He is a Fellow of the Chartered Institute of Information Security, a regular keynote speaker and a strategic advisor to entities in the public and private sectors.

Curated Industry Announcements

• Aembit: SPIFFE vs. OAuth: Access Control for Nonhuman Identities

• Apono: Apono Launches Agent Privilege Guard, Bringing Runtime Privilege Gua…

Read more