Enterprise Identity is breaking. Not because AI changed what identity is, but because AI exposed how flawed our foundation has been all along.
For decades, the industry tackled new security challenges the same way: by bolting layer upon layer onto legacy Identity and Access Management (IAM) stacks. Today, despite billions spent on those layers, Identity remains the #1 compromised attack vector.
The problem isn’t at the edges. It’s at the core of the architecture itself.
The Cost of Silos: One Rule, Ten Consoles
The modern IAM stack was built for humans who, best case, make an access decision once every few minutes. Worse, it was built in isolation.
Today, a typical enterprise identity stack is a graveyard of disconnected tools:
- Identity Providers (IdP) for single sign-on
- Privileged Access Management (PAM) for admin vaults
- Identity Governance and Administration (IGA) for compliance and recertification
- ITDR, NHI, JIT, Authentication, and Authorization engines...
Each of these systems lives in its own console, with its own workflows and its own policy language.
What does this mean in practice? If you want to enforce a simple policy, something like revoking access when a user changes roles, you have to manually define and maintain that rule across Okta, SailPoint, CyberArk, and half a dozen other consoles.
Omdia principal analyst Todd Thiemann highlighted this exact crisis:
“Identity teams use an average of 11 tools for workforce identity security... A large portfolio of tools results in operational complexity, identity silos, and inconsistent policies, increasing the risk of gaps resulting in mistakes, unaddressed issues, and security risks.”
In one real-world enterprise, the team had to manage three major IAM tools. Because none of them talked to each other out of the box, they spent 80% of their bandwidth fighting SailPoint, 30% maintaining Okta, and practically gave up on CyberArk because no one on staff was a dedicated admin.
That is the hidden tax of identity silos: three consoles, three owners, three skill sets, and zero unified context.
The AI Exacerbation: Short-Lived Agents, Permanent Exposure
Now, drop AI into this fragmented setup.
Non-human identity (NHI) and AI agents don’t change the nature of identity, but they blow the surface, scale, and speed wide open.
Unlike a human worker who logs in at 9:00 AM and sits in a session all day, an AI agent might spawn, execute ten thousand API calls across five environments, and terminate in under two seconds.
- Session length equals exposure length.
- If your access policies are static, defined in separate consoles, and re-evaluated only every few hours (or days during IGA syncs), your risk blast radius becomes infinite.
You cannot govern machine-speed entities using human-speed consoles.
Anatomy of an Attack: How Scattered Spider Exploits the Gaps
Attackers don’t break down heavy vault doors; they walk through the air gaps between your security tools.
Threat groups like Scattered Spider (UNC3944 / Octo Tempest) have perfected this playbook.
They don’t need zero-day exploits. They just use your fragmented identity stack against you.
Here is what this looks like in the real world:
Step 1: IdP Gap
Social engineers helpdesk to reset user Okta MFA.
Step 2: Target App Gap
Bypasses MFA & logs in as a standard user. Exploits un-synchronized administrative drift to elevate privileges.
Step 3: IGA Gap
SailPoint operates on a 24-hr batch sync. The attack goes completely unnoticed for days.
- The Identity Gap: Okta didn’t know the privilege elevation in the target app was unauthorized.
- The Governance Gap: SailPoint didn’t catch the drift because its reconciliation schedule runs on a batch timer every 24 hours.
- The Telemetry Gap: Because these systems don’t share real-time context on a single control plane, no alarm ever rang.
Attackers live in the space between your policies. When your tools fail to talk to each other in real time, you are handing threat actors the keys to the kingdom.
The Solution: One Control Plane, First-Class Citizens
To fix this, we have to stop treating humans, machines, and AI agents as separate problems requiring separate software categories.
Every identity, whether it’s an HR VP, a service account, or an autonomous AI agent, must be treated as a first-class citizen under a single control plane.
Instead of collecting an identity event five times and processing it across five separate consoles, enterprise security requires one unified language to authenticate, authorize, and govern.
The Game Changer: Runtime, Continuous Evaluation
Treating every identity under a single control plane unlocks the ultimate objective: Dynamic, Runtime Authorization.
Authorization can no longer be a static decision made once at the beginning of a session. It must be evaluated continuously, at runtime, at the exact moment an action is attempted.
| Approach | Core Evaluation Logic |
|---|---|
| Old Way (Static) | “Does User/Agent A have permission to access System B?” (Checked once, cached for 8 hours). |
| New Way (Dynamic & Runtime) | “Given the current threat telemetry, user context, device health, and machine-speed behavior, should this specific call be allowed right now?” |
When all context is shared natively on a single platform, runtime evaluation happens at machine speed without slowing down the business. If an agent strays from its normal behavior pattern, its permissions are instantly scoped down or revoked in real time, not tomorrow during the next batch sync.
Moving Forward
The era of bolting legacy tools together to patch self-inflicted identity gaps is over.
It’s time to shift to an identity engine built ground-up to govern, authenticate, and authorize people, agents, and machines alike at infrastructure scale, at machine speed, in a single place.
What does your identity architecture look like today? Email me your specific enterprise use case, and let’s discuss how to make real-time, unified identity a reality for your organization.
Tagged
- Identity Security
- IAM
- Agentic AI
- Runtime Authorization