At EIC 2026 in Berlin, which was two months ago, agentic AI was almost impossible to avoid. Autonomous agents, new use cases, and a good deal of speculation about where all of this is heading ran through most of the agenda. Between the sessions, though, the questions tended to be more grounded. They were less about what agents might one day become and more about what to do, now, with the non-human identities already spreading across one's own environment.
This is a question worth addressing here because it is no longer optional.
Your Best Defense Was Nobody Bothering
Something uncomfortable often underlies identity environments. What protects your over-privileged service accounts and your long-lived secrets is very often not consistently enforced policy. It is effort. These weaknesses have sat there for years without being exploited, and not because they were well hidden. Many are perfectly visible to anyone who knows where to look. The more mundane reason is that reviewing a large, sprawling estate took skilled human time, and that time was always expensive and finite.
Call it security by effort. Protection that works because breaking it costs more than it returns. Nobody chose it. It accumulated, one deferred review at a time, and it held for exactly as long as the effort stayed expensive.
In June, that assumption came apart. A new AI model arrived from a capability tier its maker had judged too dangerous in cybersecurity to release without additional safeguards. Within three days a US export-control order took it offline worldwide. By the end of the month the controls had been lifted again. The capability at the center of it is almost banal. Point the model at a codebase and have it find the flaws. That is automated vulnerability discovery, and much the same capability now sits inside other AI models. Which one hardly matters. The effort is no longer expensive.
One challenge for us as humans: NIS2 and DORA can force documentation and accountability. Neither creates real urgency. Automated vulnerability discovery does. Assume attackers can now afford to go looking.
The Part Nobody Put On a Slide: Our Current Security Measures Are at Least One Step Behind
The safest place to start is at the resource, the database, the API, the queue itself, not at a gateway somewhere in front of it. Check it there and a request has to prove it is allowed the moment it arrives, no matter which account it claims to come from. That is the check that still fires when a service account nobody wrote down starts pulling data, and in an estate this size something eventually does. Listing every non-human identity with an owner and an expiry date is worth doing too, but the list is always behind, because these accounts appear faster than anyone maintains the record. The list tells you which identities existed the last time someone checked. Enforcement at the resource covers the one making a call right now.
From there, the work moves to the credentials themselves. Long-lived static keys and service-account passwords sit at the root of most machine-identity risk, and every new agent built on an old secret inherits that exposure. The trend is moving away from permanent credentials and towards temporary, purpose-specific ones. If a team wants to make immediate progress, the most useful step is often the least sophisticated. Find the oldest, most forgotten secret in the estate, whether it is a password last rotated years ago or a vault entry that still belongs to someone who left, and retire it.
The harder shift has little to do with tooling and everything to do with habit. When an agent needs to act, the reflex is to hand it the credential. But handing a non-deterministic actor a raw token means handing over all that authority at once. The more defensible arrangement keeps the credential with a system that carries out the action on the agent's behalf, and lets the agent ask only for narrow, specific operations. Once you control what an agent can actually reach, meaning its resources, its tokens and its tools, the question of what a compromised or misbehaving agent might do becomes far easier to contain. Catalogue your agents and secure the vaults and the tools they depend on.
Authorization itself must change shape. The familiar approach, authorize once at the perimeter and then trust the session, does not survive chains of agents calling one another at machine speed. It must become continuous instead, evaluated at every step and carrying the human intent behind a request through the whole chain. At least the last part is still an open problem, and the standards for passing intent cleanly from one agent to the next are only now taking shape. Without it, one question has no answer. Who delegated what to whom, for what purpose, and under whose authority?
You Already Know Most of the Tools, and Now It Is Time to Use Them
Strip away the vocabulary of autonomous agents and the shape of the problem is recognizable. Discovery, least privilege, short-lived credentials, continuous authorization, lifecycle. What is new is the setting. These are no longer occasional hygiene tasks but controls that must hold for a fast-growing population of autonomous actors operating at machine speed and doing that well is genuinely hard. Few organizations have managed it yet but that is not a reason to wait. It is the reason to start.
What changed in June was not the difficulty of the work but the cost of avoiding it. Nobody invented automated vulnerability discovery. It simply stopped being expensive. The effort that used to keep these gaps quietly out of reach is gone, and it is not coming back.
The organizations that handle the next phase well will not be the ones that found the right AI-native platform to buy. They will be the ones that did the ordinary work properly, early, and turned security by effort into security by design. None of it is glamorous. Do it now, or wait until someone, probably an agent, finds out what you missed. Guess what? It won't tell you first.