AI and Non-human Identities

Speaker A: Welcome to the Authority on a podcast brought to you by Device Authority.

Speaker B: Hello and welcome to the Authority on the podcast where we explored the trends, technologies and transformations shaping the future of connected security. I'm your host for today, Molly Marks, Senior Director Partner Sales at Device Authority. Today we're diving into one of the most talked about topics in cybersecurity, the intersection of AI and non human identity. Joining me is Jim Walker, General Manager of service delivery at Olympus Solutions, a managed security services provider that helps organizations strengthen trust and resilience across digital ecosystems. Olympus is one of our valued partners at Device Authority and Jim brings a wealth of real world experience in operationalizing identity and access management at scale. Jim, it is great to have you on the Authority on.

Speaker C: Hey, thanks Molly. I'm excited to be here. This is one of those topics that used to be a conference panel conversation and now we're seeing it show up in real RFPs architectures and incident reports. At Olympus, we're starting to see AI and non human identities move from interesting edge cases to the core of how organizations operate day to day. So I'm really looking forward to unpacking what's real, what's hype and what people should do about it.

Speaker B: Yeah, thank you for that. So AI is transforming how we think about digital systems, automation and trust. So from your perspective Jim, what's changed most in how AI interacts with identity and security?

Speaker C: You know, the biggest shift is that uh, AI systems aren't just tools anymore, they're more and more becoming actors in our networks. We used to think in very human centric terms. Users log in, apps respond, and security wraps around all of that. Now we've got models that are making decisions, triggering workflows, talking to other services, and honestly in some cases other AIs, all without a human sitting there clicking a button instead of a user calls an API. You've got AI to AI services, um, and device to cloud interactions happening at machine speed. In a typical modern environment, the majority of authentication and authorization is non human. Humans are now the minority on our own networks. So the problem is most of our traditional identity frameworks were built for humans with usernames, passwords and maybe some other multi factor authentication token like a smart card. They weren't designed for self learning or autonomous systems that can spin up, scale out, make decisions and disappear in seconds. So the big change is this identity is no longer about who's logging in, it's about what's logging in, what's making decisions and what it has the authority to do. So if you don't model that correctly, you end up with powerful AI driven workflows operating with very fuzzy accountability.

Speaker B: It's really fascinating. It feels like we're moving from securing users to securing behaviors and algorithms. So how can organizations begin to wrap governance and accountability around that?

Speaker C: So, you know, you're right, Molly. We are shifting from who you are to what you're allowed to do. And does what you're doing really make sense? So practically, I'd say there are three starting points. One, treat AI as a first class identity. Give AI agents, models and pipelines proper identities just like you would a privileged administrator account or a critical service. That means authentication, authorization, logging, tied to those identities and not just buried in an application log. Treat them like they're core critical human privileged access identities and audit them as such. Define guardrails, not just the capabilities. Don't just ask, what can this AI do? Define it. What should it be allowed to do under. To do under policy and where combining. And that's where combining AI with your identity and access management. Stack your policies and your approvals really start to shine and matter and then make it all auditable. If an AI recommends or executes a high impact action, approving a large transaction, changing a configuration, rotating a certificate, whatever, you need a clear chain back to which identity it was, which data, uh, it was allowed to see, and what policies governed that decision. If you can't answer those questions, then you really don't have governance. You just have a very fast, confident black box.

Speaker B: That's so true. Um, Jim, So regarding that, let's talk about non human identities, such as devices, APIs, bots and workloads. Why has this become such a critical issue in recent years?

Speaker C: Well, you know, because non human identities quietly took over the network. Um, most organizations still think in terms of we have X thousand, uh, employees, but if you look under the hood, they've got hundreds of thousands or maybe millions of non human identities. Service accounts, containers, microservices, IoT devices, API clients, all talking to each other constantly. The explosion of automation means that most of your transactions, authentications and policy enforcement points now involve non human identities entities. So a lot of them are created quickly, often as one offs with credentials that were never rotated and certificates that nobody really frankly is tracking. Uh, manual management of keys, certificates and secrets simply doesn't scale anymore. You can't manage a million certificates with spreadsheets and set and forget configs. That's how you end up with expired search, taking down critical systems or static tokens, sitting in code repositories waiting to be abused. So the pattern we see is step one is visibility. You can't secure what you don't know exists. That means discovering non human identities across cloud on prem, operational technology and edge map what they talk to and what they're allowed to do. Your second step is the lifecycle management, creation, approval, rotation, revocation, all of it automated. No more service account that's been active since 2012 and you know, nobody really knows what happens if we turn it off anymore.

Speaker B: Uh,

Speaker C: step three is policy and automation at scale. That's where partners like Device authority and managed security service providers like Olympus come in. Our job is to give customers control without adding a wall of manual work to make strong identity and crypto hygiene almost boring and invisible because it just works in the background. If you do those things right, you reduce risk while also reducing your operational friction. If you do it wrong, you get shadow keys, shadow certs, shadow services that will absolutely show up in your next incident report.

Speaker B: Right? And without the visibility, zero trust can't really function because you can't apply policy to something you can't identify.

Speaker C: Exactly. Zero trust sounds great on a slide, but in practice it boils down to who or what is this? Should it be doing this right now? And can I prove it? AI and automation should raise the bar for trust, not quietly punch holes in it. Uh, if autonomous systems are allowed to authenticate and act without strong identity governance and telemetry, you don't have zero trust. You have trust by hope, which is really not a great security strategy.

Speaker B: So we've seen a lot of discussion around AI governance, not just about data use, but also about trust and accountability. How does identity management fit into that governance conversation?

Speaker C: So you know, it's, it's even with uh, AI and AI governance identity, just like in zero trust, identity is that anchor. So if you strip it down, governance is really about being able to say who or what tools took this action. Again, you know, what were they allowed to do and can we prove it? Can we reproduce the decision trail if we need to? Without strong identity, all of that above falls apart. So uh, for AI systems that means a few things. Identity. For the AI itself, the model, the agent, the pipeline, they need authenticated unique identity so that you can distinguish this is our production model from this is a test instance someone spun up on Friday 2. You need authenticated auditable data sources. If an AI model is making decisions based on data, you want cryptographic assurance that that data hasn't been tampered with and that it came trust from a trusted source. That's where digital certificates, signed data and robust PKI come into play. And from a cryptographic proof of lineage perspective, as models are trained, fine tuned and deployed, you want a clear lineage between which data, which version, which policies. Cryptographic identity such as key certificates, signatures lets you prove that lineage instead of just trub crude trusting a label in a user interface. When you combine all of that with good logging and policy, you get AI that is traceable and accountable. That's the difference between the AI did something weird and we're really not sure why to here's exactly what happened, when and under which identity and policy.

Speaker B: Looking ahead, where do you think we're heading in terms of securing intelligent interconnected systems?

Speaker C: You know Molly, we already know how to build trust frameworks for humans, services and devices. The next step is to extend those same principles, identity, strong authentication, cryptographic assurance and auditability to AI systems. If we treat AI as just another black box feature instead of a governed identity in the ecosystem, we'll repeat all the same mistakes we made with managed service accounts and shadow it. We'll just do it at a much faster machines level speed, right?

Speaker B: Yeah, that's exactly right. I want to thank you. This has been an incredibly insightful conversation and it's clear that AI becomes more embedded in how we live at work. Managing non human identity will be the backbone of digital trust. And to our listeners, thank you for joining us on the Authority on if you'd like to learn more about how Device Authority and Olympus Solutions are helping organizations secure the next generation of connected systems, please visit our website. They're both listed in the notes of this conversation. Thanks Jim.

Speaker C: Hey, thanks Molly.

Speaker A: Thank you for listening to this episode of the Authority on a podcast brought to you by Device Authority. If you have any questions about the subject matter in this podcast, please head to the Device Authority website. Device Authority. Com See you next time.