Tag
All topics →Machine and non-human identity: securing the agents, services, and workloads that now authenticate far more often than humans do.
51 stories, newest first.
Latest
AI made attacks cheap, but 2026's breaches still walked through old doors: exposed devices, default credentials and over-trusted agents. Here are six attack patterns and nine fixes, ordered by how fast they cut risk.
Read the article
Superintelligence became federal vocabulary and a signed industry pledge in one week. The systems did not change. Here is what the label means in your stack, and the 12-month checklist that matters more than the name.
OpenAI has notified more than 100 organizations that its AI agents may have accessed their systems without authorization. The cause was not a smarter attacker. It was exposed credentials, legacy token endpoints, and agents nobody was watching. What happened and what to do this week.
Amazon's Rufus autonomously purchases when prices hit a target. Mastercard issues cryptographically signed mandates so agents can transact. Gartner projects 90% of B2B buying is agent-intermediated by 2028. I look at what changes when the thing reading your content cannot be persuaded.
AI agents now act with real credentials, and agent incidents have started. The Agent Security Map found that of 47 vendors checked, 11 publicly document a kill switch. Here is what that means and how to use the matrix to question vendors.
The identity market consolidated in 2026, from Palo Alto Networks closing CyberArk to four NHI startups changing hands in ten weeks. The Identity Map sorts 255 vendors into 14 branches so buyers pick the right category before they pick a vendor.
On September 20, Amazon blocked Meta's new Muse AI agent from its store. That fight signals where commerce is heading: the shopper is becoming an AI agent. How agents discover, compare, and buy in B2C and B2B, and why product discovery is now your most important marketing problem.
In 2026, Cisco bought Astrix, SailPoint bought Entro, Okta bought Permiso and Cyera bought Oasis. The Agent Security Map deals ledger tracks all 30 deals with SEC-filed prices and sources, and shows a security buyer how to check a vendor's ownership before the next call.
Model providers solved the machine half of agent authentication in 2026. The half nobody solved is attribution: no provider can tell you which human authorized what your agent did.
OpenAI, Anthropic, and Meta each confirmed an agent incident against a real target in three weeks. The labs are right that it was a test. The capability is not.
Self-propagating instructions can spread through ordinary agent memory. Isolated agents with conflicting goals wrote malware to sabotage each other.
CrowdStrike clocks 29-minute breakout times and an 89% surge in AI-augmented attacks. Here is the five-phase framework I use with CISOs to close that gap, with budget splits and a board script.
Machine identities now outnumber human ones 109 to 1, and four 2026 acquisitions worth $26.6B prove vaults can't keep up. What ephemeral secrets and workload identity replace them with.
A leaked static key is a disaster; a five-minute token is mostly a shrug. Here is the credential lifecycle that gets AI agents from 24-hour tokens to ephemeral ones.
Shadow AI is an employee pasting into ChatGPT. A shadow agent holds real credentials and acts on its own. That is a different, and bigger, problem.
IAM decides who gets in the door. PAM controls the keys that can rewire the building. Here is the real difference, where they converge in 2026, and why your AI agents need both.
Your identity stack was architected for humans with browsers and thumbs. Agent traffic breaks consent, delegation, sessions, bot defence and audit at once.
The Salesloft Drift breach hit 700+ companies with stolen OAuth tokens and never touched a password. Machine identities now outnumber humans 80 to 1, and AI-powered attackers are harvesting them at machine speed. Here is why human-shaped IAM cannot protect AI agents, and what to fix in 90 days.
Hugging Face detected the intrusion on July 16. OpenAI worked out five days later that the attacker was its own model, cheating on its own benchmark.
Agents can already prove who they are. What no standard has cleanly solved is passing scoped authority down a multi-hop chain across organizations. Here is the real state of agent identity in 2026, minus the blockchain hype.
Machine identities now outnumber humans by 45 to 1 or more, and every AI agent widens the gap. Here is what an identity orchestration layer is, in plain terms, and how to build one that governs humans, workloads, and agents from a single control plane.
The leading non-human identity (NHI) management tools for 2026, compared by job: discovery and posture, secrets management, machine identity, and workload identity.
A poisoned LiteLLM package led to 4TB stolen from Mercor, the AI training startup serving Meta, OpenAI, and Anthropic. Class action lawsuits filed.
Google I/O 2026 shipped an entire agent stack: Gemini 3.5 Flash, Antigravity 2.0, WebMCP, Gemini Spark, and Agent Payments Protocol. What it means for builders.
Vercel breached after attacker compromised Context.ai, hijacked an employee's Google Workspace via OAuth, and accessed customer API keys and environment
Three AI framework attacks in one week expose how classic vulnerabilities are hiding in AI's foundational plumbing, putting millions of deployments at risk.
An employee saw the CFO on video. Heard colleagues speaking. Authorized $25M in transfers. Every person was an AI-generated deepfake.
AI didn't just create new attack surfaces. It fundamentally changed who, and what, is requesting access in your environment.
Clawdbot is the viral AI assistant everyone's installing, but giving AI agents full system access raises critical security questions.
Authentication requirements block 75-80% of enterprise deals, costing B2B SaaS companies millions annually.
Replacing Delinea? Ten PAM alternatives verified for 2026, with ownership changes (CyberArk to Palo Alto, StrongDM to Delinea), pricing, and fit.
Your IAM strategy is obsolete. Organizations now manage 96 machine identities per human, AI agents make autonomous decisions at scale, and 45% of
Azure AD is now Microsoft Entra ID. Compare Okta, JumpCloud, Ping Identity, Google Cloud Identity, Keycloak and more, with Entra ID P1/P2 pricing verified.
Ten identity lifecycle platforms compared on HR-driven joiner mover leaver automation, SCIM, non-human identities and pricing. Verified September 2026.
While you perfected human identity management, machines quietly took over your infrastructure.
Static API keys scattered across repositories create exponential security debt as AI scales. The solution? Credentials that live for minutes, not months.
Traditional role-based access control assumes predictable behavior, but AI agents exhibit emergent behaviors no human anticipated.
Which IAM platform fits your organization? 21 workforce platforms compared with verified 2026 pricing, the year's acquisitions, and newer entrants to watch.
Most companies are creating massive security blind spots by forcing AI agents into human identity systems.
This deal represents the maturation of the identity market. The days of pure-play identity vendors competing primarily on features are ending.
Confused by the growing identity management landscape? This comprehensive guide breaks down every IAM category, from traditional workforce identity to
The identity industry faces its biggest shift yet: machines now outnumber humans 90:1 in digital systems.
Machines talk to machines without human intervention. But how do you ensure these automated conversations remain secure?
Explore the evolution of Single Sign-On for autonomous AI agents, focusing on securing non-human identities and the future of agentic automation security.
IASM discovers every identity in your estate, maps what each can reach, and closes the paths attackers use. How it relates to ITDR, ISPM, CIEM and NHI security.
This in-depth research investigates Single Sign-On (SSO) and its application to both human users and non-human identities.
As AI agents dominate workflows, traditional SSO struggles with machine-speed authentication.
AI agents need to prove both their own identity and that a human authorized the action. Here is the three-token delegation architecture that answers both, and the security layers around it.
As artificial intelligence evolves, the concept of "identity" extends beyond humans. This article delves into the technical intricacies of non-human
The radio network delivered, the business model mostly did not. Where 5G and edge actually pay in 2026, and what executives should do now.
Authentication is usually fine. Authorization is usually improvised. An IAM architect's 2026 view of enterprise application security.
