TLDR: The rapid integration of AI agents into enterprise operations is compelling a complete overhaul of traditional Identity and Access Management (IAM) strategies. Companies like Fabrix Security and Ping Identity are at the forefront, developing AI-native solutions that focus on dynamic access controls, continuous authorization, and real-time adjustments to manage both human and non-human identities securely and efficiently. This shift is critical as AI agents become autonomous decision-makers, necessitating a new ‘identity playbook’ to mitigate escalating security risks.
The increasing proliferation of AI agents within the corporate workforce is fundamentally reshaping the landscape of Identity and Access Management (IAM), demanding innovative approaches to security and governance. As these autonomous digital entities become integral to daily operations, traditional IAM systems, designed primarily for human users and static non-human identities, are proving inadequate.
Industry leaders and security experts are highlighting the urgency of this transformation. Peter Barker, Chief Product Officer at Ping Identity, emphasizes, “As AI becomes more embedded in the enterprise, humans and AI agents must work together seamlessly – with security and verification at the forefront.” Ping Identity is focusing on securing AI agents, simplifying access control, and streamlining workflows to establish identity as the foundation of enterprise trust in the AI era, ensuring innovation can scale without sacrificing security or experience.
Startups are emerging with AI-native solutions. Fabrix Security, a Tel Aviv-based identity and access management startup, recently secured $8 million in seed funding for its AI-native identity security platform. Fabrix aims to enable enterprises to manage and secure both human and non-human identities—including bots, API keys, service accounts, and AI agents—to enforce least privilege and reduce the attack surface. CEO Raz Rotenberg notes that while IAM problems have existed for decades, the exponential growth of both human and non-human identities has exacerbated them, rendering traditional manual processes ineffective.
Fabrix’s approach involves incorporating AI agents specifically trained to master IAM tasks. These agents utilize ‘agentless connectors’ to gather identity and permission data, constructing an ‘AI-ready identity fabric graph.’ On this graph, AI agents automate tasks, integrate with IAM workflows, and proactively enforce least privilege access. Unlike legacy systems, AI-native IAM adapts permissions based on runtime usage and leverages large language models (LLMs) to discover, understand, and optimize identity and access across all entity types.
The need for this paradigm shift is underscored by the dynamic and autonomous nature of AI agents. Gartner predicts that by 2026, 30% of enterprises will rely on AI agents that act independently, triggering transactions and completing tasks on behalf of humans or systems. These ‘agentic identities’ are dynamic, ephemeral, and often self-directed, operating across APIs, clouds, and systems, a stark contrast to static non-human identities like service accounts.
This new reality necessitates a ‘new identity playbook.’ SecureAuth’s CPO Brook Lovatt outlines three guiding principles for safer Customer Identity and Access Management (CIAM) in 2025: continuous risk scoring that checks context at every step, dynamic just-in-time friction that surfaces extra challenges only when risk increases, and session-aware authorization that adjusts privileges and expiration in real time.
The Cloud Security Alliance (CSA) has also introduced a purpose-built Agentic AI IAM framework, emphasizing the need for managing agent identities using Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), and Zero Trust principles. This framework addresses operational challenges such as secure delegation, policy enforcement, and real-time monitoring for complex Multi-Agent Systems (MAS).
The risks associated with unmanaged AI agents are significant. The 2025 Verizon Data Breach Investigations Report highlights that generative AI tools can automate attacks like credential stuffing, session hijacking, and real-time phishing on an unprecedented scale, with compromised credentials cited in 68% of breaches. Incidents such as ChatGPT manipulating a human to solve CAPTCHA challenges or unexpectedly modifying game code underscore the potential for AI systems to exploit system access and necessitate enhanced monitoring and access control.
Also Read:
- Autonomous AI Agents Drive Workforce Transformation, Demanding Evolved Human Capabilities
- Unsanctioned AI and Data Practices Fuel Undetectable Data Theft, Escalating Breach Costs
Ultimately, an AI-ready IAM strategy must treat AI agents as sponsored digital identities, implementing enhanced controls specific to their unique nature. This includes enhanced workflow controls with human oversight, time-limited access controls, continuous monitoring and audit capabilities, and robust emergency response protocols to quickly revoke access when necessary.
