Last week, our Chief Cyber Officer Sriram Santhanam was in Las Vegas for Identiverse 2026 — the world's largest event dedicated to digital identity. He was there to moderate a panel session at the Non-Human & Agentic AI Identity Summit, a half-day event that brought together CISOs, IAM leaders, AI governance teams, and security architects around a question the industry is still working out: how do you govern identities that don't behave like humans?
It's a question that's moved fast from fringe to urgent.
The problem is already here
For most of the history of identity and access management, the mental model was simple: a person authenticates, gets access, and does something. You built controls around that loop. You trained people, set policies, reviewed access logs. It was imperfect, but it was manageable.
That model is breaking down.
Non-human identities — service accounts, API keys, bots, microservices, AI agents — now vastly outnumber human ones in most enterprise environments. And unlike a person, an AI agent doesn't wait for approval. It acts at machine speed, interprets context, makes decisions, and kicks off work further down the chain. It can replicate itself. It doesn't forget credentials, but it also doesn't know when it's been compromised.
The Non-Human & Agentic AI Identity Summit was built around this reality. As the session description put it: organisations are deploying AI agents that operate with limited human oversight, pushing traditional IAM, security, and governance models beyond their original design. The result is a fast-growing, largely ungoverned attack surface — where access is routinely over-privileged, accountability is unclear, and existing controls were never built for identities that can reason and act independently.
Sriram has been thinking about this problem for a long time.
Two decades of IAM — and the shift that changed how he thinks about it
Sriram's career spans more than twenty years building and scaling enterprise security programs across cloud and hybrid environments. Large-scale identity initiatives. Global workforces. Partner ecosystems. Millions of customers.
But his perspective shifted when he moved to an AI technology company and started operating at the intersection of identity, automation, and autonomous systems. Suddenly, the assumptions that had anchored his career — the ones about average-case behaviour, predictable access patterns, human-in-the-loop governance — no longer held.
Moving from identity-first programs to securing AI-driven platforms reshaped how he thinks about access, trust, and governance — a shift where non-human identities, machine-speed decisions, and edge cases are now the norm.
That's not a theoretical observation. At Human Managed, we process billions of events daily across identity, network, endpoint, cloud, and AI infrastructure domains. We see what happens when automated systems act without context, when agent pipelines acquire permissions they shouldn't have, when the gap between what an identity can do and what it should do becomes an attack surface rather than a governance footnote.
It was, in many ways, the right room for him to be in.
What the conversation was really about
The summit drew a diverse group of practitioners: engineers, architects, CISOs, compliance leaders, and founders building tools specifically for this problem. Topics ranged from governance standards and control models to what identity architecture actually needs to look like when AI agents — not people — are the ones requesting and using access.
Accountability kept coming up. When an AI agent initiates an action, who's responsible? When it acquires access dynamically, who approved it? When it interacts with another agent — one you didn't deploy, in an environment you don't fully control — how do you maintain visibility?
These aren't rhetorical questions. They're the gaps that attackers are already probing.
What made the summit valuable wasn't a single answer to any of this — there isn't one yet. It was the quality of the people willing to be honest about where the gaps are, and serious about what it takes to close them. A room full of practitioners who've moved past the talking stage and into the messier, more necessary work of figuring out what governance actually looks like when the identities doing the work aren't human.
Why identity is where AI security gets decided
It's easy to think of AI security as a model problem — a question of training data, adversarial inputs, alignment. Those things matter. But in practice, most enterprise AI risk materialises through identity. Through an agent that has too much access. Through a credential that was never rotated. Through a workflow that assumes trust it was never explicitly granted.
Identity is the control plane for what AI agents can do in the real world. Get it wrong, and the rest of the security architecture doesn't matter.
That's what Identiverse has always understood, and why this year's Non-Human & Agentic AI Identity Summit felt like a genuinely important moment. The identity community is grappling with something the broader security industry is still catching up to: that the rise of agentic AI doesn't just add a new category of risk. It changes the nature of the risk landscape itself.
Sriram's view is that the challenge isn't just designing for the average case anymore. It's designing for extremes — for the edge cases that become the normal case when you're governing systems that can act, adapt, and replicate at scale.
What comes next
We'll be sharing more from Sriram on the non-human identity challenge — the patterns we're seeing across client environments, the governance gaps that show up most often, and what a practical response looks like when your identity estate includes more agents than humans.
If you were at Identiverse this week and want to continue the conversation, reach out to the team. And if you're working through how to govern AI agents in your own environment, we'd welcome the chance to think through it with you.
That work is already underway. We'll keep sharing what we're seeing.
Identiverse 2026 ran June 15–18 2026 at Mandalay Bay, Las Vegas. The Non-Human & Agentic AI Identity Summit was held on June 15 2026.
