AI-Driven Non-Human Identities Challenge Business Security Models in Brazil

In the evolving landscape of digital security, AI-operated non-human identities such as service accounts and autonomous AI agents have outnumbered human users within companies, creating new risks for business security. These AI entities often hold excessive permissions and operate autonomously across local, hybrid, and cloud environments, challenging traditional Identity and Access Management (IAM) models, which are now deemed insufficient.

According to a recent KPMG study, 59% of companies suffered data breaches caused by third parties in the past year, highlighting vulnerabilities linked to compromised non-human identities. Furthermore, 61% of American companies express discomfort with the full autonomy of AI agents, underscoring the need for human oversight.

To address these challenges, organizations must adopt adaptive governance frameworks based on Zero Trust principles. This involves rigorous verification, minimal access privileges, and runtime monitoring with emergency kill switches to thwart suspicious AI activity without operational disruption. Implementing cloud-native solutions and managing digital certificates are key in securing modern architectures like microservices and serverless computing.

KPMG advocates for centralizing the discovery and cataloging of all identities to maintain updated inventories and integrating log data with advanced intelligence tools for proactive Identity Threat Detection and Response (ITDR) and continuous security posture management. Moreover, fostering a security culture led by CISOs collaborating across risk, data governance, and legal teams is critical to establishing a trustworthy AI framework.

The urgency to modernize governance and embed security by design is clear: acting now ensures businesses can leverage AI innovation without compromising integrity and control over autonomous systems.