The convergence of fragmented identity data and accelerating AI agent deployment is putting distinct pressure on security leaders in Southeast Asia and Hong Kong. Regional research reveals that while agentic AI adoption outpaces resilience planning, only 34% of organisations have extended resilience planning to non-human identities—with Hong Kong showing particularly acute gaps at 23%.
As Singapore firms race to deploy AI agents, research shows up to 95% of organisations feel pressured to loosen identity controls for AI.
In Hong Kong, financial regulators are actively piloting "Know Your Agent" frameworks for payment workflows, signalling a regulatory trajectory that will reshape compliance expectations.
As non-human identities proliferate faster as organisations deploy AI agents into their workflows, a recurring, and in my view growing, challenge for CISOs and CIOs is turning fragmented identity data into actionable privilege‑path intelligence for AI agents.
Gartner's research suggests the scale of the problem is clear. By 2028, it predicts 70% of CISOs will rely on identity visibility and intelligence capabilities to shrink the IAM attack surface, because identity has become the primary vector for compromise as machine and human identities multiply beyond the reach of siloed tools.
The analyst firm goes further, warning that by 2028 a quarter of breaches will route through agent-based attack surfaces, driven by poor machine identity hygiene and a lack of context-aware policy controls.
For CISOs, the question may no longer be whether fragmented identity data is a problem. It is whether they can turn that fragmentation into something actionable before the agents they deploy outrun their ability to see them.
BeyondTrust's field chief technology officer, James Maude, offers a blunt assessment: the visibility gap around AI and non-human identities isn't a peripheral concern; it's the primary challenge facing security teams today.
"Many are adopting AI tools without consulting their CISO," he says, "leading to a proliferation of identities that are hard to track." The result is an environment where agents are already present, already privileged, and often already invisible.
The visibility problem beneath the agent boom
Maude's diagnosis begins with a simple but uncomfortable observation. Organisations don't need to decide whether to adopt AI; they've already done so, often below the waterline of formal IT governance.
"Organisations must recognise that AI is already integrated into their systems," he says, "and develop strategies for visibility over both AI and human identities."
The implication is that any strategy built on the assumption of a clean, known starting point is already obsolete.
What makes this phase different from earlier waves of identity sprawl is the relational complexity. It is not simply that there are more identities. Relationships among human, machine, and AI identities create paths no single inventory can capture.
Maude stresses that "understanding the relationships among human, machine, and AI identities is crucial to managing risks effectively."
A service account with modest permissions may inherit reach through a federated trust; an AI agent spawned by a low-code workflow may aggregate data from systems its creator never intended to touch. The identity itself is not the risk. The path is.
Why static inventories fail the agent test
Many security programmes instinctively respond to visibility gaps with more discovery. Maude sees the logic but warns against stopping there. "While increased visibility is beneficial," he says, "it is crucial to integrate intelligence to evaluate the data effectively."
The distinction matters because the volume of agent identities can fluctuate rapidly, and a list—however comprehensive—captures only a moment. CISOs need to identify high-risk actions and know "when privilege boundaries are crossed among numerous agents."
This is where privilege-path intelligence becomes operational, not aspirational. Maude describes the need for tools that "analyse system interactions and audit actions through a privilege lens," focusing on critical high-risk areas rather than attempting to review every action.
His example is instructive: a user with no significant privileges in Entra ID may gain extensive access to AWS through SSO. The risk lives in the hidden pathway, not the direct assignment. For organisations deploying agents across cloud and SaaS environments, those hidden pathways multiply with every new integration.
Governance that treats agents like people—and then better
The organisations Maude sees managing AI implementations effectively share a common discipline. They establish controls and processes "to prevent unintended consequences" and engage proactively with AI teams to address organisational issues, rather than treating agent security as purely technological.
The alignment mechanism is familiar: "AI agents receive only necessary permissions, akin to human onboarding practices." Least privilege, human approval for critical actions, revocation after use—these are not novel principles. What is novel is applying them to identities that may exist for seconds, operate autonomously, and spawn their own sub-agents.
Maude's cautionary example is a case in point. An AI agent granted privileges like a developer produced "disastrous outcomes."
The failure wasn't a sophisticated exploit but a governance lapse: an agent was given standing access appropriate to a human role, without the contextual limits a human would implicitly understand.
The lesson is that treating agents like people is a starting point, not an endpoint. Agents need the same least-privilege discipline, but they also need something humans do not: explicit boundaries around what they can do when no one is watching.
The audit trail question
When an agent takes a privileged action, accountability becomes urgent. Maude is direct about the current state:
"Organisations currently lack adequate audit trails to identify whether the fault lies with the AI, the human operator, or the individual who deployed the AI." James Maude
The problem is not merely technical logging. It is the absence of a clear chain of authority that ties an action to an owner, a justification, and a boundary.
His prescription has three parts. First, establish clear ownership and management protocols so that blame can be differentiated when something goes wrong. Second, require human approval and clear justification for AI agents' actions in production. Third, revoke privileges after use rather than allowing standing access. "Auditability is essential," he says, "to track who approved the actions and what occurred, whether it was the AI or a human."
For CISOs in regulated markets like Hong Kong, where supervisory expectations around explainability are tightening, this is not a nice-to-have. It is the difference between a defensible control environment and an unexplainable incident.
Containment when an agent goes wrong
The containment question follows naturally. If an agent is compromised or behaves unexpectedly, what limits the blast radius?
Maude's answer returns to least privilege, but adds a dimension: visibility into sub-agents. Organisations must maintain visibility "not just the agents themselves but also any sub-agents they might spawn," enabling proper audit trails and emergency responses.
Adopting a least-privilege approach "minimises the blast radius of potential attacks, such as prompt injections or code exploits." By lowering the standing privileges of both human and AI identities, the damage from any single compromise remains manageable.
This is as much a resilience argument as a security one. In an environment where agents are dynamic and sometimes unpredictable, the goal isn't to prevent every failure, but to ensure no failure cascades. The organisations that struggle are those where agents carry persistent, broad access because no one designed an alternative. The ones that cope have engineered containment into the architecture before the incident, not after.
The productivity pressure and the policy response
Maude doesn't pretend broad agent access is always a governance failure. He says informal AI use is inevitable because employees adopt powerful tools on their own. "The real risk lies in lack of visibility and control," he argues, "especially when sensitive data is exposed through unapproved platforms."
Banning AI is ineffective. The practical path is to set clear policies, provide approved tools, and encourage experimentation within secure boundaries—prioritising strict controls for high-risk use cases while enabling low-risk experimentation.
This is a more nuanced position than the binary choice between lockdown and laissez-faire. It accepts that shadow AI will exist and focuses effort on making the sanctioned path easier than the unsanctioned one. For CISOs facing business pressure to grant agents broad access, the answer isn't to refuse, but to build the guardrails that make safe access possible.
What 2027 demands
Maude's closing advice for the year ahead warns against solving a silo problem with more silos. "The solution to the silo challenge in organisations does not lie in adding more technology silos, such as AI or machine identity tools," he says.
Instead, a holistic approach is required, "focusing on aligning products, people, organisational structure, and processes around shared concepts of identity and security." The challenge extends beyond technology and often involves people and processes.
For CISOs in Southeast Asia and Hong Kong, the implication is that privilege-path intelligence is not a product category to purchase but a capability to build—across teams, across jurisdictions, and across the human–machine divide. The agents are already here. The paths they create are already forming.
The work of 2027 is to see those paths clearly enough to decide which ones to keep, which to restrict, and which to sever.
Click the PodChats player to hear Maude's views and recommendations on turning fragmented identity data into actionable privilege‑path intelligence for AI agents.
- The cybersecurity tech stack keeps growing in complexity as best-of-breed standalone security tools proliferate. Since 2021, however, we've seen an aggressive consolidation on the back of platformification. What is your take on this?
- From your observations, what is the true scope of non-human identity proliferation across organisations' environments in Asia, and how confident are CISOs in the completeness of that picture?
- How do you see enterprises, and their CISOs, governing the privilege paths that connect AI agents to critical assets?
- When an AI agent takes a privileged action, can you reconstruct the full chain of authority that permitted it?
- If an AI agent is compromised or behaves unexpectedly, can you suggest best practices for containment and recovery strategies that have proven to be effective? In this context, what won't work and why?
- How should CISOs balance the business pressure to grant AI agents broad access for productivity against the principle of least privilege?
- How should CISOs align with emerging regulatory expectations for agent identity governance across the jurisdictions they operate in?
- What is privilege-path risk, and what metrics should CISOs use to demonstrate that privilege-path risk is shrinking (which is good), not just being monitored?
- Who owns AI agent identity risk at organisations in Asia—and is that ownership sustainable across the silos where agents operate?
- What should worry CISOs and CIOs as they enter 2027?
