When I work on an incident, the first question I ask is almost never "what malware ran." It's "whose credentials did it use, and what was that account allowed to touch." Nine times out of ten, the interesting part of the story isn't the exploit. It's the access. The exploit gets you in the door. The privilege is what lets you walk through the building.
For thirty years, that question had a human-shaped answer. A person clicked something, a person got phished, a person reused a password, an admin left a service account sitting on a domain controller with a password from 2014. The identity at the center of the incident belonged to somebody with a badge and a manager. That assumption is quietly dying, and most enterprises have not adjusted their controls to match.
The actor on your network is increasingly not a person at all. It is a workload, a script, a bot, an API (application programming interface) client, and now an AI agent that can reason, plan, and act on its own initiative. These non-human identities (NHIs) already outnumber human ones in most environments, and the gap is widening. The industry is finally naming the problem out loud, and two developments in the summer of 2026 made that official.
The Market and the Government Showed Up in the Same Month
In July 2026, the cybersecurity accreditation body CREST (the Council of Registered Ethical Security Testers) launched its AI Charter, a voluntary commitment now backed by more than seventy cyber firms worldwide, built around nine principles for responsible AI use in service delivery.[1] Roughly a tenth of CREST's global membership signed on as founding signatories.[1] Strip away the launch language, and the interesting part is what the signatories are agreeing to govern: accountability, transparency, and a clearly defined scope for what AI-enabled systems are permitted to do inside a client's environment. That is an access question wearing a governance jacket.
Days earlier, the UK's National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology (DSIT) published the blueprint for Cyber Shield, a national-scale program to hardwire agentic AI into machine-speed cyber defense.[2] The vision describes "red" and "blue" agents that discover vulnerabilities and contain threats in real time, operating across organizational boundaries. Read the fine print, and one line does the heavy lifting: these agents are "enabled by strong foundations of data, identity, reliability, cyber security, and regulatory compliance," and they must "secure the means to identify, trust and communicate between themselves."[2] A national government, standing up an offensive-and-defensive AI capability, put identity and trust at the base of the stack. Not the model. Not the compute. The identity.
That is the whole argument in one sentence, delivered by people who do not sell identity software. When you give an autonomous agent the authority to make changes in production, the security question stops being "is the model good" and becomes "who is this thing, what is it allowed to do, and how do we revoke that when it goes sideways." Identity is infrastructure. Privilege is the risk.
Why Agents Break the Privilege Model We Already Had
We spent a decade getting marginally better at human identity. Multi-factor authentication, conditional access, lifecycle/governance processes that mostly work. None of that machinery was built for an actor that spins up in milliseconds, authenticates with a static secret, and may spawn other actors to finish its task.
Consider how an agent actually gets its access. It rarely sits behind a human login with a second factor. It holds a credential: an API key, an OAuth token, a certificate, a secret pulled from a config file, or, worse, hardcoded in a repository. That credential is frequently long-lived, broadly scoped, and attached to no lifecycle at all. Nobody offboards a service account when the project ends. Nobody rotates a key because a contractor left. The identity just persists, over-permissioned and forgotten, which is exactly the profile an attacker hunts for.
This is not theoretical grandstanding. When the Open Web Application Security Project (OWASP) published its Non-Human Identities Top 10 in 2025, the top-ranked risk was not some exotic model-poisoning attack; it was improper offboarding. This was followed immediately by secret leakage and, further down the list, over-privileged NHIs and long-lived secrets.[3] Those are not AI problems. Those are privileged hygiene problems that AI agents inherit and amplify, because now the neglected identity can think and act instead of just sitting idle.
The threat data points in the same direction. Verizon's 2025 Data Breach Investigations Report found that stolen credentials were the single most common initial access vector, present in roughly a fifth of breaches, and that stolen credentials showed up in nearly nine out of ten basic web application attacks.[4] Attackers are not mostly breaking authentication. They are logging in. When the credential belongs to a non-human identity with standing privilege and no human watching it, that login is cleaner, quieter, and harder to attribute than anything a phished employee produces.
Now layer agentic behavior on top. A traditional service account does one predictable thing. An AI agent is designed to be non-deterministic (the same prompt won't always produce the same sequence of actions). It decomposes a goal, chains actions, calls tools, and adapts. Give it broad standing privilege "so it doesn't get blocked mid-task" (which is exactly how these things get provisioned under deadline), and the result is an insider that never sleeps, never questions its instructions, and can be steered by anyone who compromises its inputs. Prompt injection (feeding an agent manipulated input to hijack its next action) is not a content-moderation curiosity. In an agent with real permissions, it is privilege escalation by another name.
Five Controls that Actually Reduce AI Agent Risk
None of this means agentic AI is too dangerous to deploy. It means the access has to be engineered as deliberately as the capability. The good news is that the disciplines that work here are not new. They are the same privilege-centric fundamentals we have argued for on the human side for years, applied to identities that happen to lack a pulse.
- Start with discovery. You cannot govern what you cannot see. Most enterprises genuinely do not know how many non-human identities exist in their environment, who owns them, what they can access, or which secrets they carry. That inventory is unglamorous, and it is the entire foundation. Every agent, every service account, every token needs an owner, a purpose, and an expiry.
- Attack standing privilege directly. The most valuable thing you can take away from an attacker is persistent, always-on access to a powerful identity. Non-human identities should hold the least privilege required for the task in front of them, and ideally hold it just in time rather than permanently. Short-lived, scoped credentials are issued at the moment of need and expire immediately after the window collapses; an attacker has to work with. A leaked token that died ninety seconds ago is not a breach. A leaked token that lives for a year is a campaign.
- Kill the long-lived secret wherever the platform allows it. Static keys buried in code and config are the diesel that keeps these incidents running. Rotate what you cannot eliminate, vault what you cannot rotate, and stop treating a secret in a repository as a config detail instead of a live grenade.
- Give agents a real identity and continuous validation. Not a shared password in a text file. If an agent is going to act on its own, it needs to be a distinct, attributable principal whose trust is verified continuously against its behavior, not granted once at provisioning and assumed forever. The NCSC blueprint understood this instinctively when it insisted its agents must be able to identify and trust one another before they cooperate.[2] Implicit trust is precisely what modern zero trust architecture was designed to remove, and the National Institute of Standards and Technology (NIST) has been explicit that trust must be evaluated continuously rather than inherited from network location or a one-time login.[5]
- Demand accountability at the session level. When an agent does something consequential, you need to know which identity acted, under whose authority, against what, and be able to pull that authority instantly. Session-level visibility and a working kill switch are not paperwork. When an agent is compromised or simply misbehaves at machine speed, the ability to see it and stop it is the difference between an anomaly and an incident report.
The Uncomfortable Part: The Privilege Debt Agentic AI Is Now Collecting On
Here is the truth the roadmaps tend to skip. Most organizations struggling with agentic identity today were already struggling with basic privilege hygiene yesterday. The dormant admin account, the shared service credential, the access nobody ever revoked, the standing privilege granted for convenience, and never revisited. AI did not create those failures. It industrialized them and handed them the ability to act.
That is also the opportunity. The controls that contain an autonomous agent are the same controls that should already be containing your human privileged access: least privilege, just-in-time elevation, no standing access, continuous verification, no long-lived secrets, and full session accountability. Getting them right for non-human identities is not a separate program. It is the discipline you owed the environment before the agents showed up, finally taken seriously because the threat now moves faster than you can.
CREST's charter tells you the market has decided this deserves governance. The NCSC's Cyber Shield tells you that a government has decided that identity and trust are the foundation on which an autonomous future is built. Both arrived in the same month for the same reason. The actor changed. Whether it has a pulse or not, the question at the center of the incident is still the one I have been asking for thirty years: who has access to what, and can you take it away right now? If your answer for your agents is "we're not sure," an attacker already knows, and that is a race you do not want to enter a lap behind.
About the Author: Len Noe is a Solutions Architect at BeyondTrust, Transhuman, Podcaster, International Cyber Security Speaker, Author, Technical Evangelist, and Biohacker with 11 implanted microchips. A former blackhat with more than 30 years in technology, he has presented in over 70 countries and is featured in the documentary I Am Machine, which premiered at DEF CON 2025.
About BeyondTrust: BeyondTrust is the global leader in privilege-centric identity security, protecting Paths to Privilege™. Identity alone doesn’t create risk. Privilege does. As human, machine, and AI agent identities explode across every environment, BeyondTrust is the only company built to discover, control, and secure privilege across all of them from a single platform. Trusted by 20,000+ customers, including 75 of the Fortune 100, and recognized as a multi-category leader by top industry analysts, BeyondTrust reframes identity security from a management problem into a strategic advantage. Learn more at www.beyondtrust.com.
References
- [1] CREST, CREST AI Charter: Building Trust in AI-Enabled Cybersecurity | https://www.crest-approved.org/ai-charter/
- [2] National Cyber Security Centre (NCSC) and Department for Science, Innovation and Technology (DSIT), Cyber Shield: The Path to an Agentic AI Future for Cyber Defence | https://www.ncsc.gov.uk/blogs/cyber-shield-the-path-to-an-agentic-ai-future-for-cyber-defence
- [3] OWASP Foundation, OWASP Non-Human Identities Top 10 – 2025 | https://owasp.org/www-project-non-human-identities-top-10/2025/top-10-2025/
- [4] Verizon, 2025 Data Breach Investigations Report | https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- [5] NIST SP 800-207, Zero Trust Architecture | https://csrc.nist.gov/pubs/sp/800/207/final
