Ep # 14 - Turning an AI Breach into a Case Study

Identity security was built for a human world — but that world is changing fast. As organisations enter the agentic AI era, non-human identities, AI agents, credentials and autonomous access are creating a new set of security challenges. But Henrique argues that the industry shouldn't throw away decades of identity knowledge — it should apply it more intelligently to this new era. Henrique Teixeira, SVP of Strategy at Saviynt and former Gartner analyst, joins Mr. NHI to discuss what the last decade of breaches has taught us, why identity remains the common denominator in the attack chain, and why organisations need to rethink how they approach NHI and AI identity. The conversation also explores the growing technical debt around API keys, service accounts and OAuth tokens, why AI security has become an undefined "goo" of overlapping categories, and why organisations should build a broader identity programme covering humans, NHIs and AI agents. What you'll learn: Why traditional identity security was built primarily around humans Why agentic AI security and NHI security aren't necessarily the same thing Why AI agents may behave more like employees than software Why organisations need to assume breach and focus on detection and recovery How decades of NHI technical debt are creating new attack opportunities Why identity remains a common denominator throughout the attack chain Why organisations should build one identity programme covering humans, NHIs and AI agents Why clear taxonomy matters in the increasingly confusing AI security market How runtime access control and intent-aware authorization could change AI security What the Hugging Face incident teaches us about NHI risk Key Moments Introduction & Meet Henrique [00:00–03:11] Mr. NHI's Human Identity in the Hot Seat [03:11–09:42] Turning a Breach into a Case Study [09:42–14:35] Why Identity Is the Common Denominator in Every Attack [14:35–16:15] Why AI Security Has Become “Goo” [16:15–19:40] The NHI Technical Debt Problem [20:06–25:20] Building an Identity Programme for Humans, NHIs & AI [23:31–29:36] Saviynt's Zuma: Insights, Access & Governance [29:36–32:09] Runtime Authorization & Intent-Aware Access [32:10–34:23] The Hugging Face Lesson & Closing Advice [34:23–38:07] 📚 NHI Knowledge Centre: nhimg.org 🔗 Saviynt: saviynt.com #cybersecurity #nonhumanidentity #iam #aiagents #agenticsecurity #agenticai #identitysecurity #zerotrust #digitalidentity #nhi #artificialintelligence #ai #ciso #machineidentity #Saviynt