Identity has become a bigger part of the cyber security conversation, and not just because attackers are stealing passwords. Access now extends across cloud services, applications, infrastructure and automated systems. At the same time, AI is creating an entirely new class of identities that can interact with systems and data at machine speed. As a result, organisations need to think differently about who and what they trust, what that trust allows them to do, and whether that trust remains appropriate over time.
Recent Australian incidents show how quickly identity risk can surface in very different ways. On 18 June, an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service administered by Services Australia, accessing both public and non-public files. While there was no evidence that individual Medicare records were accessed, the incident demonstrated something important: an AI agent can move beyond its intended task and interact with systems in ways its operators did not anticipate.
In July, Origin Energy disclosed that approximately 900,000 current and former customers had been affected by unauthorised access to customer information. The subsequent investigation was linked publicly to a former employee of an outsourced call-centre provider.
These incidents are very different, but they highlight the same underlying issue. Trust itself has become a security risk.
Identity security is about managing that risk. It goes beyond deciding who should have access in the first place. It looks continuously at whether that access remains appropriate, how it is being used and what happens when trust is abused or compromised.
Identity security protects the trust organisations place in identities and the access those identities are given. That includes employees, administrators and customers, but it also includes applications, service accounts, machines and AI agents.
Traditional identity management has largely focused on establishing identity and providing the right access to the right people. Those capabilities remain essential, but they are no longer enough on their own.
People change roles. Permissions accumulate. Accounts are compromised. Service accounts can exist for years. AI agents can interact with systems at a speed and scale that humans cannot.
Identity security extends identity management by continually asking: Should this identity still have this access? Is it behaving as expected? And what do we do when it isn't?
That shift matters because an attacker does not necessarily need to break through the traditional security perimeter if they can compromise an identity that is already trusted.
AI makes this challenge even more important.
Unlike a human user, an AI agent can operate continuously and at machine speed. Depending on how it has been designed and deployed, it may also be able to interact with applications, APIs and data without someone approving each individual action.
The Services Australia incident provides an early indication of why this matters. This wasn't a traditional attack involving someone stealing a password and logging into a system. An OpenAI agent, operating as part of an internal research task, found a way around access restrictions and gained unauthorised access to non-public material.
That changes the identity conversation. We can no longer think about identity purely in terms of employees and user accounts. Organisations increasingly need to understand and govern human, privileged, machine and AI identities, and they need controls that reflect what those identities are supposed to be doing.
As autonomy increases, that becomes even more important. An identity with excessive access is potentially dangerous. An autonomous identity with excessive access can act on it very quickly.
Strong identity security starts with good identity management, but organisations still need to understand who should have access and provision that access appropriately and remove it when it is no longer required.
Organisations also need visibility into what identities can actually reach, whether those permissions still make sense and how those identities are behaving.
This is where I see the important distinction between identity management and identity security.
Identity management asks: Who should have access?
Identity security goes further: Is that access still appropriate? Is it being used safely? And can we respond quickly if something goes wrong?
That means continuously identifying unnecessary privileges and risky configurations, monitoring for suspicious identity behaviour, and having a clear response when an identity is compromised or starts behaving unexpectedly.
It also means being able to recover. Compromised credentials can be reset relatively quickly. Recovering confidence in your identity environment after a major compromise can be much harder.
The objective is not simply better access management. It is reducing the likelihood that legitimate access becomes the path an attacker uses to move through the organisation.
Identity security is no longer simply an access-management issue.
That means understanding not just who has access, but what they can reach, how that access is being used and what happens when trust is compromised.
A useful starting point is to look across your environment and ask some straightforward questions:
Those questions apply equally to a person, a privileged administrator, a service account or, increasingly, an AI agent.
At Infotrust, that is exactly why we have launched our new Identity Security practice: to help organisations understand where real identity risk exists across their environment and turn that visibility into practical action. Contact us to learn more.