BeyondTrust: Agentic AI is an 'old new' identity problem

Plus ca change, plus c'est la meme chose: the more things change, the more they stay the same. Call it the technology industry paradox, where the developments are new and often staggering but the concepts are ancient - and agentic AI, with its deluge of new identities to be managed, is less a 'different' problem than an old one arriving 'more, and faster'.

That was the point of departure for BeyondTrust Field CTO James Maude. "Fundamentally the core hasn't changed as agentic AI becomes part of the everyday. Agents might not be human, but they are still just identities and should be managed as such," he said.

The trouble, Maude explained, is that organisations treat AI agents in a way they would never treat a person. "Simply put, if you had an intern or a new hire who's starting your organisation today, you wouldn't make them a global admin with the associated access. But spin up an AI agent, and people are doing exactly that."

The fault, then, lies not in the constellation but in the configuration. Couple that with how easily agents replicate and how useful they are, and an explosion is to be expected; Gartner reckons the average Fortune 500 company will be running as many as 150,000 AI agents by 2028, up from around 15 in 2025.

Having used agentic AI and seen the future, we reckon that's on the conservative side.

The precise count matters less than the ratio, and who is left to look after it. "Already we've got non-human identities at ratios of 45 to one, 100 to one, higher. But the teams managing the security settings for this dramatically increased team of identities haven't grown, and nor have their budgets and tooling," Maude said.

Hunters and farmers

Maude split organisations into two camps. 'Hunters' answer agentic AI with more AI-powered tooling and dedicated teams chasing prompt injection and other novel attacks. "The hunters need a high level of skill, and their luck is going to run out at some point. It doesn't scale very well as the identities scale out."

Hunters, of course, have always relied on an element of good fortune to bring home the bacon. When we suggested 'luck' should have no place in cybersecurity strategy, Maude was quick to agree. "It shouldn't have any place in any security strategy. But unfortunately, that's what a lot of organisations have been relying on."

'Farmers', by contrast, recognise problems they've seen before, Maude continued. "Instead of hunting, we put resources in pens, silo them off, and put in controls so if something happens with the livestock, it's contained."

Privilege as a tool

Identity is one thing; privilege is another, though the two are joined at the hip. Overprivileged humans tend to show some restraint (though far from universally). Agents have no such moral or other qualms and take instructions very literally, as fans of the TV show Silicon Valley might remember from Gilfoyle's AI, Son of Anton.

That makes them risky.

"Overprivilege a machine identity and it will just do things in the fastest, most efficient way possible," said Maude, explaining that access is simply a tool an agent uses to get things done. Even if those things are unexpected and destructive. "With free rein, an agent may find a misconfiguration, elevate its own privileges to finish a task and – in the worst cases – take out production systems because it decided that was the best way to fix a bug."

Blind men and elephants

Part of the answer, Maude said, is a big-picture view, which rests to some extent on organisational maturity. Fragmentation gets in the way, and he reached for the parable of the blind men and the elephant: one feels a leg and describes a tree trunk, another the tail and describes a rope. Swap the blind men for siloed business units and security teams, and there's an elephant in the room that nobody's seeing.

"If this was just a technology problem, we'd have probably solved it by now," Maude said. "Instead, even within security there's fragmentation - an identity access management team, a privileged access team, an intrusion detection team and now an agentic AI team. They're looking at identity from their singular perspective rather than the whole and the connections between the systems."

The common factor, he suggested, is identity and privilege. "It doesn't necessarily matter who or what an identity is. Instead, the bit that matters is what they can do. That's what informs your risk."

That means treating the identity attack surface like the software attack surface, prioritising the changes that remove the biggest chunks of risk.

Many organisations, he said, arrive at privileged access management (PAM) for regulatory or cyber insurance reasons, tick the box and move on. He believes compliance should be the floor, with zero standing privilege as a north star. "Now you might not be able to get zero standing privilege in every system all the time, but it's a great direction to go in on that journey."

Coasting, after all, has its own risk. "You don't want to be the low hanging fruit in the industry who's just ticked the compliance box and done nothing else because then you're the most vulnerable in your industry."

Modern PAM, he said, means just-in-time entitlements across cloud and development environments, and a human in the loop before agents make high-impact changes. "That's the issue, and ultimately, we still need a control point to make that call."

Treat agents, in other words, like new interns. Plus ca change.