AI agents are forcing a rethink of digital identity, cybersecurity experts warn – THINK Digital Partners
As AI systems gain greater autonomy, organisations must rethink how they manage digital identities, permissions and accountability, cybersecurity experts have warned.
Posted 20 October 2026
The growing use of autonomous AI agents is challenging traditional approaches to digital identity and access management, raising questions about how organisations can safely give AI systems authority to act on their behalf.
Speaking at Pax8 Beyond EMEA, cybersecurity experts Mostyn Thomas and Matt Lee (pictured) warned that existing security controls may struggle to keep pace as AI agents move beyond providing information to carrying out tasks across connected systems.
Lee, security and compliance senior director at AI and cloud marketplace Pax8, argued that identity management must evolve to account for the actions AI systems can take once authenticated.
An AI agent operating with legitimate credentials could still take actions that are unintended or potentially damaging. Lee said organisations must consider not only what an identity can access, but what it can modify and what changes it can make to a system.
Thomas, senior director of security, EMEA, at Pax8, argued that access controls will need to become considerably more granular, potentially restricting permissions to particular activities or time periods.
“It can’t just be Matt has got access to this, or Matt’s bot has access to this,” he said.
Instead, organisations may need to define precisely when an agent can act, under what circumstances and within what limits.
The speakers also questioned whether organisations have enough visibility over the growing number of non-human identities operating within their environments. As AI agents become integrated into business processes, they require credentials to access applications, retrieve information and interact with other systems.
Lee warned against allowing agents to operate using existing human identities, arguing that they should have separate, traceable credentials.
“Don’t give it your identity. Have a separate identity you track and delegate,” he said.
However, the governance challenge begins before an agent receives its credentials.
“Who’s allowed creating a bot? Who has the authority to say there’s an identity?” asked Lee.
Organisations must also establish who decides what an agent can access and how those permissions are approved.
The discussion also challenged the assumption that greater automation necessarily produces better cybersecurity outcomes.
Lee acknowledged the advantages of using AI to accelerate threat detection and response, but described an incident in which AI models reportedly failed to identify malicious data exfiltration because the activity resembled legitimate cloud storage transfers.
A human analyst questioning the unusually large volume of data being transferred ultimately identified the suspicious activity.
Lee argued that keeping a human ‘in the loop’ does not go far enough. Organisations must retain oversight of automated decisions and accept responsibility for their consequences.
“You are also responsible for the outcomes, and you are also needing to own those outcomes as a human, but also as a company,” he said.
By 2030, he predicted, organisations will face greater pressure to explain why an AI system behaved as it did and what safeguards were in place.
Another concern is the speed at which autonomous agents can act. Lee suggested organisations assess the potential damage an agent could cause within five minutes, then design restrictions around that risk.
These could include transaction limits, restrictions on system changes, isolation between applications and human approval for sensitive actions. He also emphasised the importance of being able to intervene quickly.
“Where’s my kill switch?” he asked, drawing comparisons with physical safety mechanisms in industrial environments.
The ability to contain incidents, revoke permissions or reverse unwanted changes should therefore be built into autonomous systems from the outset.
Despite these emerging risks, the speakers argued that many underlying cybersecurity challenges remain familiar, including identity management, least-privilege access and effective oversight. What’s changing is the speed at which weaknesses can be exploited and the potential consequences when automated systems are given extensive authority.
For government organisations preparing to deploy more autonomous AI capabilities, the message is that established security principles remain relevant, but applying them to systems that can independently take action will require more rigorous controls.
Subscribe to our newsletter to receive the latest digital transformation news directly to your inbox.
Follow us on social media to keep up to date with the latest technology news.
Engage with our audience
Call for Speakers/Papers
Sustainability Policy
UK Modern Slavery Act Statement
Anti-Corruption Policy
Contact us
THINK Digital Partners
Sign up to our newsletter for a round-up of news.
© 2026 Copyright THINK Digital Partners.
Home | Privacy Policy | Terms of use | Contact
Register today to secure your place.
Register today to secure your place.
Register today to secure your place.
source
This is a newsfeed from leading technology publications. No additional editorial review has been performed before posting.
