[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG8mnbd6WPqRrAphyLCBycB8viKaLWACSTdyx5ovyWGs":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"f3bf9228-4b38-475c-afde-b41618450396","The Replicant in Your Directory: AI Agents and the Identity Security Gap","the-replicant-in-your-directory-ai-agents-and-the-identity-security-gap-f0d2bd","AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access. Netwrix explains why stronger visibility and identity governance are essential as AI expands the enterprise attack surface. [...]","As organizations deploy AI agents, machine identities now outnumber human users by up to 50:1 in many environments, but identity governance frameworks built for human lifecycle management struggle to track, own, and control these rapidly multiplying accounts. The 2026 Netwrix report shows organizations experiencing rapid AI-driven identity expansion face a 43% breach rate versus 11% for those with stable identity footprints, highlighting the governance gap even among mature security programs.","AI agents proliferate non-human identities faster than governance can track, expanding enterprise attack surface.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-replicant-in-your-directory-ai-agents-and-the-identity-security-gap\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F06\u002F27\u002Fcyberpunk-header-image.jpg","2026-07-10T14:00:10+00:00","2026-07-10T16:00:22.072969+00:00",7,[17,20,23,25,28,31],{"name":18,"type":19},"UNC6395","threat_actor",{"name":21,"type":22},"Netwrix","vendor",{"name":24,"type":22},"Salesloft",{"name":26,"type":27},"Drift","product",{"name":29,"type":30},"OAuth","technology",{"name":32,"type":30},"Machine Identity Management","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":33,"icon":35,"name":36,"slug":37},null,"Identity & Access","identity-access",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":57,"vendors":144},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":59,"product_name":83,"url":84,"description":85},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":87,"name":88,"problem":89,"products":90},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":116,"name":117,"problem":118,"products":119},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":161},"ai-agent-identity-sprawl-creates-governance-crisis","AI Agent Identity Sprawl Creates Governance Crisis","Organizations deploying AI agents are generating machine identities at a rate that far outpaces the governance frameworks designed to manage them, with machine-to-human identity ratios reaching 50:1 in some environments. Traditional identity lifecycle management — built around human onboarding, role changes, and offboarding — fails to account for the dynamic, ephemeral, and often auto-provisioned nature of AI agent accounts. Unmanaged machine identities represent high-value, low-visibility attack surfaces that threat actors can exploit without triggering standard user-behavior alerts. The stark breach rate disparity (43% vs. 11%) demonstrates that identity sprawl is not merely a governance inconvenience but a measurable, material security risk.",[150,151,152,153,154,155,156,157,158,159,160],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 8 – Audit Log Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-2 \u002F IA-9 (Identification and Authentication – Machine Entities)","NIST SP 800-53 AU-12 (Audit Record Generation)","NIST AI RMF – Govern 1.1 (Accountability for AI systems)","ISO\u002FIEC 27001:2022 – A.5.15 (Access Control)","ISO\u002FIEC 27001:2022 – A.8.2 (Privileged Access Rights)","GDPR Article 25 – Data Protection by Design and by Default","ITIL 4 – Service Configuration Management (tracking non-human entities as CIs)",{}]