Sweeping changes to ERP, agentic AI and IT consumption models have rendered traditional IDM and GRC tools arcane. The future lies in identity management that spans across all processes and identity types, and then tracks them constantly.
Information security teams are under duress. Not only do they have to cope with a more complex range of attackers and attack types than ever before, but they are also seeing new, gaping vulnerabilities open up, even across their most trusted and most critical applications. The reason for this latter challenge is clear: the old identity models that were once at the heart of defences are no longer fit for purpose in the age of AI.
Those defensive plays are at the end of their lives as clearly as Microsoft DOS, DEC minicomputers, or the dodo. Like Monty Python’s parrot in the famous comedy sketch, they are no more, they have ceased to exist, they are bereft of life, they are resting in peace… at least as a trusted part of a progressive IT security infrastructure. But, unlike Polly the unfortunate pet bird, infosec and identity can be revived.
To understand the context of this, let’s start by saying that security teams are being squeezed from several directions because of multiple recent inflexion points. The most important applications – ERP systems from the likes of SAP, Oracle and Microsoft – are moving to the cloud and enterprises are following them to get the latest technology, rapid updates and all the other familiar cloud advantages.
So corporate ERP is in flux because these moves are effectively mandatory. Any major change can be a threat to security as infosec teams step away from familiar routines and expose elements that were once behind a firewall. But now this is especially risky because of another megatrend in the form of agentic AI.
No more citadels
Once upon a time, a company could say it was “an SAP shop” or “an Oracle shop” and rely on vertical integration provided by the supplier in question and its own IT team to defend core processes and services. Agentic AI means that the traditional approach of defending one key application at a time, in descending order of criticality, doesn’t work.
Today, agentic AI has swept away that approach because its very power depends on agents and sub-agents splitting processes into tasks and sub-tasks. The agents move laterally across systems. They dive and swoop into ERP systems but also other key systems: ticketing solutions like ServiceNow, cloud infrastructure platforms like AWS or CRM systems like Salesforce. All this is broadening the attack surface and means you can’t depend on an individual ERP software citadel to defend critical activities.
In the agentic AI era, all bets are off. You can’t rely on static defences, provisioning and permissions in applications because the nature of agentic AI is that it depends on porous computing infrastructures where applications and infrastructure allow ingress and egress. Processes are not linear but complex swarms of activity in a fragmented environment where the old controls for effective governance are rendered null and void.
Changing identity
The old identity management defences weren’t made for the modern identity scenario where nonhuman identities, service accounts and machine inputs outnumber human identities by tens or hundreds to one. This change disrupts everything and it means that everything you thought you knew about enterprise IT is now wrong. Software licensing based on metering and seat count has been bombed out of the water, for example, and companies are already seeing ‘bill shock’ as a result of their new, AI-infused infrastructures being such a poor match for the old tariffs.
The old model of IDM and GRC has been gazumped because they are not built for the dynamic, close-to-runtime tracking and constant checking of agent activities that is needed today. Those models, developed decades ago, don’t understand what’s going on in terms of agent provenance; they can’t track in real time, and they can’t detect anomalous actions that act as red flags for CISOs.
What’s needed is a new approach to identity that is designed for the agentic AI time. That means a common control plane across applications capable of tracking identities, (human, machine or AI) from creation to deletion. In the new world, processes can be controlled and risk scores assigned. Advice and recommendations are provided to improve those scores with the new identity model acting as a robo-advisor to take the pressure off CISOs and CIOs.
There are ancillary benefits to this. Governance is a constant background activity so there’s no quarterly fire drill to meet rules. Software usage becomes auditable and the causes of those large bills can be understood in real time. Agent activity is visible and can be managed to stop any rogue or undesirable actions.
Agentic AI is changing IT and changing industries. Every smart leader wants to use its power to create new, faster processes and enable speed to market, lower costs and gain maximum ROI from their new cloud ERPs. But that comes at a price for security and governance. They need to act now to refresh their approaches to identity to gain the new power without new risks.
