The fortnightly read for identity practitioners.
Clear breakdowns of the standards, tools and threats shaping the industry.
Views and interviews from identity practitioners doing the work.
What vendors are launching, what is changing and what is actually worth paying attention to.
THIS NEWSLETTER IS POWERED BY CLUTCH
One question I keep coming back to with Agent Identity is when a normal non-human Identity actually becomes an Agent Identity. IDPro published a piece this week that tries to draw that line, and I thought it was one of the more useful explanations I have seen.
A traditional workload can obviously have an Identity, authenticate into another system and make API calls. What it does is normally fairly predictable though because somebody has already written the code, the systems it talks to are known and the permissions it needs can usually be worked out beforehand.
An AI Agent can behave quite differently. It might decide which tool it needs, choose between several APIs, chain multiple actions together or hand part of a task to another Agent.
That makes a normal service account model quite a bit harder to use. Give the Agent enough static access to cover everything it could potentially decide to do and it can end up massively over-privileged, but keep the permissions too narrow and somebody has to keep approving new access.
Attribution gets harder as well. If an Agent is acting for somebody, calls another Agent using its own Identity and that second Agent then accesses another system, simply recording the final service account does not tell you much about what actually happened.
IDPro's view is basically that the line gets crossed when software starts making meaningful decisions about what to do, rather than simply executing a predefined set of instructions. That seems like quite a useful distinction because it gives Identity teams something more practical to look for than whether a vendor happens to call something an Agent.
The timing is interesting because quite a lot also moved on the standards side this fortnight. The IETF's Workload Identity Practices document has reached Last Call, covering things like how workloads authenticate without relying on long-lived secrets.
At the same time, the WIMSE working group updated its AI Identity Management System draft and several Agent-specific drafts moved forward. They look at things like binding an Agent conversation back to its Identity, proving what authority an Agent has when it operates across different organisations and linking credentials to evidence of what an Agent actually did.
You can start to see a distinction emerging between identifying a piece of software and dealing with what happens when that software can decide what to do next.
There was another interesting bit of timing this week. IDPro published a separate piece on 1 November looking at why Identity needs a way to quickly stop Agents when trust starts spreading during an incident, then CrowdStrike announced an AI Kill Switch two days later designed to stop an Agent, prevent it running again and cut its network access.
Once software can act quickly and make decisions for itself, detecting that something has gone wrong only gets you so far. You also need to be able to stop the Identity and the access behind it quickly enough to matter.
So rather than only asking how many non-human identities you have, I would probably be asking how many of them belong to software that can actually decide what to do next. If something can dynamically pick tools, chain actions, delegate work or act on behalf of somebody else, managing it like another predictable workload starts becoming quite a bit harder.
Join the Southern Hemisphere’s largest Identity event with speakers from brands such as Rio Tinto, Telstra, Unisuper, Commonwealth Bank, Great Southern Bank, Melbourne Airport and so many more.
Registration is complimentary for Identity Briefing subscribers using the link below.
Start With Identity published some interesting research this week looking at 115 Identity breaches disclosed between 2021 and October 2026.
Of the 43 incidents from 2025 and 2026, 20 involved a path where there was no interactive login for MFA to protect in the first place. That works out at 46.5%.
It is worth saying this is SWI's own dataset rather than every Identity breach that happened over the period, but the incidents underneath the number are probably the more useful part.
LiteLLM is a good example. A configuration file containing an administrative key was accidentally committed to a public repository in May and the credential was never revoked.
Months later, an attacker was able to use that access as part of the chain that eventually compromised LiteLLM's release process and pushed a malicious version through PyPI and its container registries. There was no employee sitting at a login screen who could have been protected by stronger MFA because the credential already worked.
Zeabur had a similar problem with an admin token created in 2024 that had never expired or been rotated. An attacker eventually used it to access the company's Kubernetes environment and customer environment variables.
Researchers also found 26,400 valid cloud and AI credentials sitting inside public Gitee repositories this fortnight, which is a pretty good example of the same problem at scale.
An API key does not get an MFA prompt. A service account does not pull out its phone, and a token that never expires does not become safer because the person who originally created it now uses a Passkey.
SWI also found that non-human identities were involved in 32.6% of the breaches in its dataset during 2025 and 2026, compared with 15.2% in 2021 and 2022.
That probably makes it worth looking pretty closely at how many long-lived API keys and service credentials are still sitting around the environment, which ones can access production and when they were last rotated. More importantly, if you found one in a public repository tomorrow, could you work out what had used it and kill it quickly?
FIDO now estimates there are around seven billion Passkeys in use globally, while its latest Passkey Index found that 36% of successful sign-ins across participating companies now use one.
Banks are also starting to move further in the same direction. Whatever problems still exist around enrolment and recovery, adoption clearly is not slowing down very much and Passkeys are starting to look less like the new authentication technology and more like normal authentication.
Arctic Wolf says it has now seen more than 400 incidents where attackers abused Microsoft Teams external chat for social engineering or initial access, with fake IT support being one of the common approaches.
Microsoft also published research into attacks that started with help desk impersonation and eventually moved into Active Directory Certificate Services abuse. If an attacker can turn that initial access into a certificate representing a privileged Identity, resetting the password or closing the original session may not actually remove the access they created.
It is another reason the help desk is starting to look less like a support function and more like part of the Identity perimeter.
Bank of America has started warning customers not to hand their banking username and password to AI tools or Agents acting on their behalf.
That sounds obvious, but most online accounts were built around a person logging in directly. If an Agent is going to act for that person, simply handing over the person's credential is probably the easiest option and also one of the worst ways of doing it.
At some point, those services are going to need a way of giving the Agent its own Identity and a restricted amount of authority instead.
Start With Identity analysed 33 Identity acquisitions announced across 2025 and 2026. Identity vendors made 18 of them but accounted for only around $790 million of the $62.96 billion in priced deal value.
There is a big caveat because the CyberArk and Wiz deals make up a huge amount of that value, but the buyers are still interesting. Companies including Workday, Cyera, Snowflake and IonQ have all bought into Identity.
The more interesting part for me is that Identity is increasingly being bought by companies whose main business is data, HR, security or infrastructure rather than Identity itself.
Google Threat Intelligence and Mandiant have published research into Agentic penetration-testing frameworks including ARTEX, Hexstrike and CAIRN being used by threat actors.
These tools can carry out multiple parts of an attack, choose between different actions and work through problems without somebody manually controlling every step. That is quite a bit more interesting than attackers simply using an LLM to write phishing copy or code because the AI is starting to take part in the attack rather than just help somebody prepare it.
Password manager mSecure has contacted current and former customers after detecting suspicious activity and recommended that customers consider changing passwords, resetting 2FA and removing or re-enrolling Passkeys.
There still is not enough public information to know exactly what happened or whether customer vault data was accessed. The fact Passkeys are included in the recovery advice is worth keeping an eye on though, particularly around how easily users can identify, remove and replace them when something goes wrong.
Identity at the Center released episode #458 with Rebecca Archambault and Paul Rabinovich previewing the Gartner Identity & Access Management Summit.
Episode #456 with Joseph Carson also looks at where the reality of AI currently sits against a lot of the hype around it.
SailPoint Navigate comes to Sydney on 4–5 November 2026, with speakers joining from Rio Tinto, Telstra, UniSuper, Commonwealth Bank, Great Southern Bank, Melbourne Airport and plenty more.
It is the largest identity event in the southern hemisphere and registration is complimentary for Identity Briefing subscribers using the link below.
The Gartner Identity & Access Management Summit takes place from 7–9 December in Las Vegas.
Our full Identity World 2027 calendar is also live across Sydney, Melbourne, New York, London and San Francisco. The events cover IAM, PAM, Digital Identity, machine Identity and AI Agents, with most sessions led by practitioners sharing what they are actually doing.
I saw an interesting question come up in the Entra community this week around password changes.
Entra can allow somebody to change their password without entering their existing password first. Do you see that as a useful recovery feature or a recovery hole, and have you actually changed the default behaviour?
If you are dealing with this now, I would be interested to hear what you are doing.
Get in touch at danny@clutchgroup.co.
Identity Briefing is published fortnightly by Clutch Group, which runs the Identity Leaders Network, Identity Briefing and the Identity World events series.
Know someone who should be reading it? Forward this on.
The Identity Leaders Network is a free, global and vendor-neutral identity community.
The group comes together for virtual roundtable discussions, peer-matching meetings, dinners and through the community WhatsApp channel.
The fortnightly read for identity practitioners.
Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.
You're subscribed. Read the latest issue →