Identity is the core of cybersecurity in the age of AI

The digital security perimeter is shifting; adversaries know that identity is the foundation of defense in a Zero Trust world. As organizations stand at the crossroads of AI-driven efficiency and AI-introduced risk, they recognize that operational agility depends on distributed systems, cloud services, and AI agents, all of which place identity at the edge. A single compromised credential—human or machine—can trigger a major cybersecurity incident.

As AI becomes more deeply embedded in operations, our cybersecurity frameworks must effectively manage a human-machine hybrid operational environment. 

From networks to identities: A new security paradigm

Traditional security models were focused on networks and endpoints. Today, identity is the gateway to systems, data, and applications—driving the convergence of identity governance and authentication. Zero Trust principles require security teams to evaluate and validate access decisions continuously, not just at login.

AI strengthens this approach by enabling real-time checks for every interaction, including:

• Assessing the identity’s current network context
• Reviewing connections to other applications
• Comparing behavior against historical norms
• Detecting anomalies in authentication patterns

Having this holistic view means that access decisions are made with full awareness of an identity’s risk posture. 

AI agents as workforce identities

AI can help close resource gaps by analyzing digital footprints, cross-checking across connected domains, and deploying automated network segmentation based on conditions.

AI can also reduce review fatigue by analyzing access requests in real time. Low-risk requests can be approved automatically, while high-risk or unusual behavior triggers escalation and generates audit reports detailing the factors present that triggered the criteria for secondary review.

To support this improved efficiency, AI agents need access to systems and data. Because these agents now have credentials, they require specific policy and procedures, including:

• Credential management, allowing agent credentials to be stored securely in privileged access management (PAM) vaults
• Access provisioning, enabling systems for determining access to support agent-initiated requests
• Policy development and enforcement, with policies tailored to agent type and monitored continuously to ensure behavior remains within expected parameters

Agents should be treated as client applications with audit trails and access controls. As agents become more autonomous and capable of creating sub-agents, identity architectures must evolve. Emerging standards like the Model Context Protocol (MCP) define secure connections, dynamic registration, and consistent identity representation across platforms. Key requirements include:

• Dynamic agent registration
• Scalable consent management
• Transitive trust models for multi-agent environments
• Interoperable identity profiles
• Standardized governance frameworks

Balancing AI's promise and risk

AI offers immense potential through automated threat detection, accelerated incident response, and optimized governance. But it also introduces risks such as data leakage, poisoning, and unauthorized access. By adopting a dual approach, you can leverage AI for efficiency while implementing robust safeguards against its related vulnerabilities. 

6 key actions for managing a hybrid workforce

1. Adopt AI-driven identity governance. Implement systems that dynamically assess identity risk based on behavior, context, and network posture.
2. Distinguish between human and machine identities. Apply tailored policies and audit mechanisms for each identity type, and roles performed.
3. Treat AI agent identities as first-class identities. Assign credentials, store them securely, and monitor access rigorously.
4. Avoid proprietary identity silos. Promote interoperability through open standards and community-driven frameworks.
5. Leverage IAM for agentic identities. Enforce boundaries and monitor behavior for agents interacting with systems.
6. Mitigate AI-specific risks. Implement safeguards against data leakage, poisoning, and unauthorized access.