In January, the Cloud Security Alliance asked security professionals how they handle the identities on which their AI systems run. Fewer than a quarter of organizations had a documented, formally adopted policy for creating or removing one. More than 16% do not track when a new identity is created at all. Those identities hold tokens and standing access to production systems, and the people accountable for governing access have, by their own account, no record of them.
Authentication answers only half the question
This is the quiet arithmetic behind a phrase the industry has repeated for a decade: identity is the new perimeter. The phrase earned its place by moving the control point off the network and onto the identity. What it left unfinished is the harder half. It answers how something gets in, but not what it can reach once inside, who approved that access, or how far the blast radius extends if the credential is stolen.
That question is about access, and access is where the attack surface now lives: in the standing entitlement behind the login, the permissions an identity carries whether or not it uses them today. Multi-factor authentication and conditional access govern one moment, the moment of entry, while the exposure is everything an identity can reach afterward. A Zero Trust architecture still has to let work happen. Work requires access, and access is trust that has been granted and left in place. There is, then, no zero trust in Zero Trust. Some irreducible trust always remains, extended to whatever holds the entitlement and sitting quietly until something uses it. That residue is structural and undeclared.
Every framework assumes an inventory not built for agents
The frameworks meant to prevent this agree on something none of them quite says aloud: everyone is inventory-first. NIST’s Cybersecurity Framework makes asset management (ID.AM) a precondition for access control (PR.AA). Germany’s BSI IT-Grundschutz is more literal about the order of operations, opening with the Strukturanalyse, an enumeration of every asset in scope, before any protective control is chosen. France’s ANSSI builds its hygiene guidance on the cartographie du système d’information, and the UK’s Cyber Essentials scopes assets before applying user access control. Four vocabularies share one spine: know what you have, then govern it.
That spine rests on an assumption the authors of the frameworks didn’t think to record, as until recently it was always true: an identity enters through a process that registers it. A human joins, HR creates a record, a manager approves access, and an offboarding routine eventually revokes it. That discipline is imperfect, but it feeds the inventory that every framework assumes.
An AI agent arrives by a different route. It is spun up when a developer wires it into a workflow, or when a business user connects a tool that registers one on their behalf. Depending on the organization’s controls, there may be no requisition, no approving manager, no HR record, no leaver event when the project that needed it ends. From the moment it exists, it holds access and acts on it, and the perimeter model has nothing to grip: its instruments are built for an interactive subject, while an agent authenticates with a token and no human is behind the request.
The mismatch already leads to security incidents. Netwrix’s 2026 Data and Identity Security Report found a 43% breach rate among organizations where AI had significantly expanded the identities needing access, against 11% where it had not.
Monitoring needs a subject that holds still
The obvious objection is that behavioral detection closes this gap, and it deserves a fair hearing, as the capability is real and shipping. Runtime tools watch an agent’s tool calls, data accesses, and API interactions, learn its normal operation, and flag when it drifts; some can enforce access decisions automatically.
What that monitoring rests on is a stable subject and enough time to learn it, and human behavior supplies both. An agent’s actions are non-deterministic by design, so the envelope of normal grows wide enough to absorb the drift a baseline watches for. It keeps no working hours, so a call at three in the morning is an ordinary Tuesday. And one spun up for a single task can finish and disappear in minutes, whereas a baseline may need a full day of observation to converge.
Accounting comes before access
The discipline this calls for already exists, waiting to be applied to a class of uncounted identities. A security team can begin without buying anything.
Start with the rule that access should never precede accounting: no identity, human or otherwise, ought to hold standing permission it was never enrolled to hold, and one that is absent from the inventory should be treated as unauthorized by default rather than tolerated as an untracked exception.
From there, give non-human identities the same lifecycle every human identity receives. An agent needs an owner who answers for it, a review cadence that revisits what it can reach, and a decommissioning trigger for the day its purpose ends.
The last principle is a caution about the limits of the first two. Seeing an over-permissioned agent changes nothing about its permissions; the morning after you inventory it, it can reach what it could reach the night before. What inventory changes is the identity’s status. It moves from outside the security program, where no framework control can touch it, to inside, where the machinery an organization already runs can finally be pointed at it.
Closing the gap from the inside
A decade on, the perimeter story turns out to have described half the problem. The industry taught itself to interrogate the knock at the door until it was reasonably sure who was there. It spent far less effort on the visitors already inside, holding keys nobody remembers issuing, to rooms nobody remembers granting. Zero Trust’s undeclared gap closes by taking a full accounting of who and what is already in the building, and deciding, deliberately, what each of them should be allowed to reach.
Accounting is the precondition. Visibility does not reduce the risk, but it ends the blindness that kept the risk beyond reach. What an organization does once the agents are finally visible is a harder question, and the subject for another day.
Dirk Schrader is VP of Security Research at Netwrix. A 25-year veteran in IT security with certifications as CISSP (ISC2) and CISM (ISACA), he works to advance cyber resilience as a modern approach to tackling cyber threats. As the VP of Security Research, Dirk is working on focused research for specific industries like healthcare, energy, and finance.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.