Contributions by: Randall Gamby, James Hauswirth and Kevin Converse
The identity problem is no longer who has access. It’s what has access and what can those identities do.
TL;DR –
The identity landscape is expanding beyond human users. Organizations must now establish trust across people, non-human identities and increasingly autonomous AI agents.
Identity and access management (IAM) was historically built around the idea of governing people: proving who they are, determining what they should access and managing that access throughout the identity lifecycle. But the modern enterprise today has outgrown that model. Identity has expanded well beyond the human user.
Deepfakes and synthetic identities are making it harder to establish trust in the people interacting with digital services. Non-human identities (NHIs) are proliferating across applications, infrastructure and cloud environments. And agentic AI is introducing identities that don’t simply request access, they can make decisions, invoke workflows and take action autonomously, often without any human intervention.
IAM is entering its next evolution: from managing access for people to establishing and governing trust across people, machines and AI.
Digital transformation has fundamentally changed how organizations think about identity. Cloud adoption, automation, APIs, interconnected applications and digital services have created more identities and more relationships between those identities and the resources they can access.
The result is an identity landscape that outpaces traditional workforce IAM.
Organizations now need to answer questions such as:
These challenges are interconnected. Establishing trust at the point of identity verification (IDV), understanding and governing NHIs and securing AI agents are becoming critical components of a modern IAM strategy.
Before an organization can determine what an identity should be allowed to do, it needs confidence that the identity is legitimate.
That foundation is becoming hard to establish. Attackers are using increasingly sophisticated techniques, including deepfakes, synthetic identities and AI-powered social engineering, to impersonate legitimate users and bypass traditional verification controls.
IDV must therefore evolve beyond simply checking credentials or validating a handful of attributes. Organizations need approaches that can establish appropriate levels of identity assurance across critical events through the identity lifecycle.
This applies across both workforce and customer populations, from onboarding and account creation to authentication, high-risk transactions and ongoing identity assurance.
After 30+ years in IAM, I’ve seen programs with strong access reviews, solid RBAC and enforced MFA. Programs you’d call mature. Yet they’re still being successfully attacked. The reason? Their controls are built around the “account”, not the “person behind it”.
Consider a typical access review. The reviewer confirms that [email protected] has the right privileges, logs show normal application access and MFA credentials are current. Everything checks out for the “account”. But is Bob Smith actually the one using it? If that account is compromised, every control tied to it is now protecting the attacker and allowing them to have the same access rights as Bob.
This is the blind spot Identity Verification (IDV) addresses. IDV is a set of IAM-adjacent controls focused on a single question: “Is the legitimate user still in control of this account or is someone else operating behind it?” Until that question has a clear answer, those expensive, mature controls are ineffective.
Without IDV, a compromised account sails through every review and remains undetected until the compromise occurs. Traditional IAM controls aren’t designed to challenge the person. Session hijacking, credential theft and account takeover all exploit the same gap: the assumption that a valid account equals a valid user.
If your IAM program doesn’t include EDV, start with one question at your next access review: are we verifying the account or the person? If the answer isn’t clear, IDV belongs on your roadmap.
Randall Gamby, Principal Security Advisor, GuidePoint Security
Not every identity in the modern enterprise belongs to a person.
Service accounts, APIs, cloud workloads, CI/CD pipelines, application identities and other machines-to-machine connections are becoming fundamental to how organizations operate. These NHIs often operate at scale, change rapidly and can have significant access to applications, infrastructure and data.
Yet traditional identity programs may not provide the same level of visibility or governance across these identities as they do for human users.
That creates a fundamental challenge: organizations cannot effectively manage what they cannot see.
A modern NHI strategy starts with understanding the landscape:
From there, organizations can establish governance and controls appropriate to the identity’s purpose and level of access. This can include improving ownership and accountability, identifying excessive or unnecessary permissions and strengthening lifecycle management and establishing more consistent governance across environments.
As organizations continue to automate, the ability to discover, govern and secure NHIs will become increasingly important to managing overall identity risk.
The growth of non-human identities is changing the scale and the stakes, of identity governance.
AI, automation and cloud adoption are driving exponential growth in machine identities, yet many organizations don’t have the visibility or governance needed to manage them effectively. Service accounts, API keys, tokens, certificates, cloud roles and other machine identities can be created and changed at a pace that traditional governance processes weren’t designed to handle. The usual mechanisms, processes and technologies in place to handle human identities are not capable of providing the kind of visibility required to fully govern Non-Human Identities. This applies at all levels, from simple local service accounts to ephemeral identities used in zero trust architectures. The more complex the environment, the more opportunities there are for NHI’s to be provisioned outside an organization’s Identity Provider (IDP), unbeknownst to the IAM or IT security teams.
In addition to knowing these identities exist, organizations need to establish clear ownership and accountability, understand how privileges and credentials are being used and apply appropriate controls throughout the NHI lifecycle. Without that foundation, unmanaged or excessive access can become an invisible source of risk. Ownership should be defined based on context, i.e. what human is interacting with the NHI, what applications does this NHI interact with, what agents are leveraging this NHI, etc.
As organizations accelerate automation and AI adoption, NHI security needs to evolve alongside it. Prioritizing discovery and treating machine identities as first-class identities, with defined ownership, appropriate privilege and lifecycle controls, can help organizations scale technology without scaling unmanaged risk.
James Hauswirth, Senior Principal Consultant, IAM Strategy, GuidePoint Security
The next evolution of the identity challenge is already emerging.
AI agents are moving beyond generating content or answering questions, they can interact with applications, invoke tools and APIs, access data, execute workflows, create new agents and make decisions within defined parameters.
That changes the nature of IAM.
An AI agent may not simply need permission to access a resource. It may need authority to take action on behalf of a person, application or organization.
This introduces new questions for security and IAM teams:
These aren’t entirely new IAM concepts. Authentication, authorization, least privilege, governance and accountability remain foundational. But they must now be applied to identities that can operate with greater autonomy and speed.
Agent AI doesn’t replace IAM, it expands the scope of what it must govern.
AI agents are becoming a new class of enterprise actor and organizations need to rethink how authority is assigned to them.
Autonomous agents can interact with systems, use data and execute actions at machine speed. Unlike traditional applications, however, their behavior can be dynamic and influenced by changing context. That makes it increasingly important to establish clear boundaries around what an agent is authorized to do, on whose behalf and under what conditions.
Identity provides a critical control plane for those decisions. By connecting an agent to defined permissions, ownership and accountability, organizations can create a more consistent framework for managing autonomous activity without treating every new AI capability as an entirely new security problem.
The goal isn’t to slow down AI adoption. It’s to give autonomy the boundaries it needs to scale safely and enable innovation with AI.
Kevin Converse, Vice President, IAM, GuidePoint Security
Identity verification, non-human identity and agentic AI may appear to be separate challenges. In reality, they represent different dimensions of the same fundamental issue: how organizations establish, manage and maintain trust across an increasingly complex identity landscape.
Consider the questions each domain addresses:
|
Domain
|
Core Question
|
|---|---|
|
Identity Verification |
Is this person who they claim to be?
|
|
Non-human identity |
Who owns this identity and what can it access? |
|
Agentic AI |
What can this identity do on our behalf? |
Together, they point toward a broader vision for IAM, one that extends beyond traditional user access management to encompass identity assurance, governance, authorization, risk and accountability across the enterprise.
Organizations don’t necessarily need to start over. Existing IAM programs provide the important foundation for authentication, authorization, lifecycle management and access governance.
The opportunity is to extend those capabilities to address the identities and access patterns merging across the modern enterprise.
The objective is not simply to manage more identities. It’s to build an identity strategy capable of establishing the right level of trust, access and control for every type of identity interacting with the organization.
At GuidePoint Security, we believe the evolution of IAM requires a broader view of identity, one that recognizes how people, machines and AI are increasingly interconnected.
Our IAM services help organizations access their current capabilities, identity gaps, evaluate technologies and develop strategic roadmaps to mature your IAM strategy.
With deep cybersecurity expertise and a vendor-objective approach, GuidePoint helps organizations navigate emerging identity challenges while building on the investments they’ve already made.
Because the future of identity isn’t just about knowing who has access.
It’s about knowing what you’re trusting, what it can do and whether that trust is appropriate.
Product Marketing Manager
GuidePoint Security