The 120th Edition of the Identity Jedi Newsletter

We keep building tools to move you forward on your identity journey — and this one might be the most immediately useful yet.

IAM Workshop-in-a-Box gives you a complete, facilitator-ready kit to run one high-impact alignment session and walk out with a real 30-day plan for your program.

No guesswork. No endless meetings. Just momentum.

Ok, three drops I want to talk about at RSA this week: Andromeda Security Galaxy Release, Saviynt AI Security, and an interesting report from Aembit.

Let’s start with Andromeda Security. One of the strongest products I’ve seen of the “Young Generation,” The newcomers attacking the Identity Security market with fresh eyes, no battle scars, and the AI tailwind. Jumping into the AI security world with this latest release, we can see this class of companies shaping what the “new” Identity Security Platforms look like. What caught my eye was their use of access graphs and their notion of Zero-Touch Continuous Compliance. In their words: Moves from manual monitoring to automated enforcement. The AI and NHI world moves at a pace where automation has to be the default; if a user has to press a button to “discover” it’s already game over.

Saviynt also announces its entry into the fray around AI Security. But the biggest thing that stands out about this announcement is three words: Agent Access Gateway. Saviynt makes the jump into runtime authorization, moving them from an admin-time platform to a critical-path one. Not an easy thing to do, but if you’re not going to challenge yourself, then what’s the point, right? Bringing the full context of their platform to the runtime enforcement of agents empowers Saviynt (and their customers) to build truly rich, fine-grained authorizations for the Agentic future we all see coming.

The AI Agent Identity Crisis Is Already Here

Let me hit you with a number that should make every identity practitioner uncomfortable.

68%. That's the share of organizations that cannot clearly distinguish between actions performed by AI agents and those performed by humans, according to a brand-new survey from the Cloud Security Alliance, released this week.

AI agents are already everywhere. 85% of organizations are running them in production environments. But most agents don't have their own identity — they borrow one. 43% rely on shared service accounts. 31% operate directly under a human user's identity. Only 36% are assigned their own dedicated identity. That means AI agents are inheriting full permission sets never intended for them, creating what the report calls an "identity patchwork."

The ownership problem makes it worse. IAM teams are identified as the primary owners of AI agent access by just 9% of organizations. The function that specifically manages identity is sitting on the bench.

The foundational IAM principles we've preached for years — least privilege, identity separation, auditability — still apply. The difference now is that the principal on the other side of the access request might not be human. And most programs aren't built for that yet.

The full report — "Identity and Access Gaps in the Age of Autonomous AI" — is available from the Cloud Security Alliance.

Microsoft reports North Korean threat actors are scaling AI-generated personas to infiltrate companies through remote hiring processes that can't distinguish sophisticated fakes from legitimate workers.

Iranian hackers exploited Microsoft Intune to wipe thousands of Stryker devices, demonstrating how identity management platforms create single points of catastrophic failure in distributed work environments.

Massive funding for AI-powered personal identity protection reflects growing demand for tools that give individuals control over their digital footprint as FBI purchases location data for citizen tracking.

WIZ

That’s it. That’s the last word. Fucking Wiz….WOW! Ok you know I’ve got more words. I was today years old when I finally saw the behemoth that is Wiz, and it’s worth every single penny Google spent on it. The visualization, the data, the context…it’s all there. Need to follow a specific compliance framework, it’s there. Want to build your own framework? You can do that too. And did I mention the visualization?? Annnd, they have an API for all of it, with a built-in API console to help you build out integrations. Throw an MCP server in front of that ( If they don’t already have one and…). Needless to say, I’m impressed, and that’s pretty hard to do. I find it hard to believe that someone couldn’t be successful with that platform.

This market is moving fast, and it’s time we all speed up. Whether or not you belive AI is the future or a bubble, you can’t deny the fact that right now it’s here, and right now it’s changing everything.

Stay safe out there, stay curious, and have some fun.