Security Journal Americas hears exclusively from Eddy Abou-Nehme, CEO of RevNet about how the changes within the identity security industry.
Artificial intelligence is changing the way organizations work at an incredible pace. AI assistants are drafting reports, analyzing data, writing code, managing workflows and even making decisions that once required human oversight.
While much of the conversation focuses on productivity and innovation, another shift behind the scenes deserves equal attention: AI is fundamentally changing identity.
Previously, identity and access management (IAM) has centred on people.
Employees, contractors, partners and customers all needed verified identities and carefully managed access to business systems.
Security teams built policies around user authentication, least privilege enforcement and monitoring of suspicious behaviour.
Today, organizations are interacting with far more than human users.
AI agents, automated workflows, APIs, service accounts, bots and machine identities now access sensitive applications and data every day.
These digital identities are becoming essential to business operations, yet many organizations still manage them using processes designed for a much simpler environment.
As AI adoption accelerates, identity security must evolve beyond protecting people alone.
Organizations need an approach that establishes trust across both human and non-human identities while maintaining visibility, governance and accountability.
Most organizations can estimate how many employees require access to business systems.
But fewer have an accurate inventory of every machine identity operating across their environment.
Machine identities include service accounts, automation tools, cloud workloads, containers, APIs, robotic process automation, AI applications and intelligent agents that perform tasks independently.
Unlike human users, these identities often operate continuously, communicate directly with other systems and scale rapidly.
The issue is that every identity represents potential access.
As organizations adopt AI-powered tools, the number of identities expands dramatically.
Each new application may create additional credentials, authentication tokens, API keys, certificates or privileged service accounts.
Without effective governance, these identities accumulate over time, creating unnecessary risk and increasing the organization’s attack surface.
The challenge is not simply the number of identities, but understanding who or what each identity represents, what resources it can access and whether that access remains appropriate.
Security teams have spent years refining controls around employee onboarding and offboarding.
Machine identities often receive far less attention, but require the same level of discipline.
Traditional insider threats have focused on employees, contractors, or trusted users who intentionally or unintentionally misuse their access, putting sensitive systems and data at risk.
AI changes this model by introducing autonomous systems that can perform actions on behalf of users.
An AI assistant may retrieve sensitive files to answer a question. An automated workflow may trigger financial transactions.
A machine learning model may access customer records to generate recommendations.
None of these systems are malicious.
However, each operates under permissions granted by people.
If those permissions are overly broad, poorly monitored or never reviewed, AI can unintentionally expose sensitive information or perform actions beyond what was originally intended.
In many cases, the greatest risk is not the AI itself but the excessive trust placed in the identities supporting it.
This is why organizations should think beyond the traditional definition of insider threats.
Every trusted identity, whether human or machine, should be governed by the same security principles.
One of the biggest obstacles organizations face is simply understanding their identity landscape.
Many environments have accumulated thousands of dormant accounts, unused service accounts, forgotten credentials, legacy integrations and outdated permissions over many years of growth.
Cloud adoption, mergers, remote work and digital transformation have only added to this complexity.
Introducing AI into this environment may not necessarily create new problems, but can amplify existing ones.
Before organizations can effectively secure AI, they need clear visibility into every identity operating across their infrastructure.
That means answering basic but critical questions, such as:
Without accurate answers, organizations are making security decisions with incomplete information.
Identity security begins with visibility because organizations cannot protect assets they cannot see or don’t know exist.
The principle of least privilege has long been considered a cybersecurity best practice. In the age of AI, it becomes even more important.
Every identity should receive only the permissions necessary to perform its intended function and nothing more.
This applies equally to employees, administrators, applications and AI systems.
Over time, permissions naturally accumulate as employees change roles and projects expand.
Temporary access becomes permanent, and automation tools gain additional privileges to support new business requirements.
Without regular review, identities gradually acquire far more access than they actually need.
AI systems operating with excessive permissions increase organizational risk because they can process large amounts of information quickly and at scale.
Strong identity governance ensures that permissions remain aligned with business needs rather than historical convenience.
Regular access reviews, automated provisioning and continuous monitoring help reduce unnecessary privilege before it becomes a major security issue.
Modern identity security is moving away from assumptions of trust toward continuous verification.
Simply authenticating an identity once is no longer sufficient.
Organizations are evaluating additional factors throughout every session, including device health, location, behavioural patterns, risk signals and requested resources.
This approach aligns closely with Zero Trust principles, where every access request is evaluated based on the current context rather than prior assumptions.
As AI systems become more autonomous, continuous verification of machine identities is equally important as it is for humans.
Organizations should monitor not only whether an AI application has authenticated successfully, but also whether its behaviour remains consistent with expected business functions.
Unexpected data access, unusual transaction volumes or interactions with unfamiliar systems may indicate compromised credentials, configuration issues or unauthorized activity requiring investigation.
Continuous monitoring helps organizations detect problems earlier while reducing reliance on static security controls.
Organizations understandably want to adopt AI quickly to improve productivity and remain competitive.
However, governance should evolve alongside innovation rather than after it.
Security teams should be involved early when new AI solutions are introduced, ensuring that identity requirements are considered during implementation rather than becoming an afterthought.
This includes establishing ownership for machine identities, defining appropriate access policies, maintaining inventories of AI-enabled applications and creating processes for ongoing reviews.
Just as organizations have formal onboarding and offboarding processes for employees, they should develop lifecycle management for machine identities.
Every identity should have a clear purpose, an accountable owner, appropriate permissions and a defined process for review or retirement.
Good governance enables innovation by providing confidence that new technologies can be adopted securely.
Identity has become one of the most important control points in modern cybersecurity because nearly every digital interaction begins with trust.
Whether the request comes from an employee, an automated workflow, or an AI-powered application, the same questions apply.
As organizations continue to integrate AI into daily operations, consistently answering these questions is important.
The future of identity security is not about choosing between protecting people or protecting machines. It is about recognizing that both now operate together within the same digital ecosystem.
AI is transforming the way businesses operate, but trust remains the foundation of every secure digital interaction.
As the number of both human and machine identities continues to grow, identity security must evolve with them.
Organizations should treat every identity as a critical security asset, regardless of whether it belongs to a person or a machine.