Trending Articles
Trending Topics
Trending
This article is part of our Opinions section, where we invite industry professionals to share their views on the most pressing technology questions of our time.
Somewhere inside a major enterprise, an identity-related security alert has gone off. It could be a false alert. It could even be the start of a breach that cripples the business by nightfall.
Security teams spring to action. Logs get pulled. Tools spin up. Slack channels probably explode. And then… time stretches on. 11 hours in fact, because according to research by Enterprise Strategy Group (now Omdia), that’s how long it takes on average to resolve a single identity-related security alert.
That’s 11 hours just to untangle what might be the most common and fastest-moving threat in modern computing. How did things go so wrong?
The uncomfortable truth behind that question is that tech may have gotten identity in computing wrong.
The tech industry has scattered its digital environments across clouds, data centres, SaaS tools, developer platforms, and legacy systems over the years. Each one comes with its own way of defining, authenticating and logging identity.
The outcome of that is a world of invisible borders. All these different cloud platforms, servers, Kubernetes clusters and databases each behave today like independent countries with their own passports and rules. Humans, machines and now AI agents are all trying to move between them, and no one’s got the complete map.
Security teams, meanwhile? They’re flying blind when investigating identity incidents, like trying to investigate a suspect through a dozen jurisdictions – each with incompatible paperwork and missing files.
That is why attackers keep winning. Identity-based breaches are easy to launch and hard to stop. Credential theft alone accounts for one in five data breaches, and the attack type rose 160% in 2025. Once a key or password is compromised, finding who’s behind it can take days, if it even happens at all.
Curiously, the ESG also found that enterprises rely on 11 different tools on average to investigate identity issues. In other words, not only are identities fractured, but so are the tools used to manage them across infrastructure. And none of them has the complete picture: each holds its own logs and blind spots.
Trying to stitch all of that information into one cohesive narrative is a nightmare. If you want to know who accessed a database, or which permissions were used, good luck. It doesn’t help that the noise level keeps rising. False positives consume attention, while real alerts get buried. Teams can’t move workloads or adopt new technologies confidently because they can’t see how identities behave across the stack. They can’t see if the movement that happened from Okta to AWS to Kubernetes was legitimate, or lateral movement in disguise.
Throw AI into that mix and you’ve got an even bigger problem. AI agents introduce more credentials, and therefore more vulnerabilities. AI also gives attackers the ability to automate and drive up the volume of identity abuse by an exponential amount. That’s probably not unrelated to why the ESG reports that 52% of enterprises now consider data privacy the biggest AI risk.
We build identity on the wrong foundation. At some point, as an industry, we started equating identity with credentials, access tokens and accounts. But that’s not what identity is, or should be anyway.
An account is not an identity. Logging into someone’s account doesn’t make you them, any more than holding their car keys makes you the owner. Identity isn’t stored in a database; it’s a verifiable property that must be derived as opposed to copied.
How do we fix identity? As a starting point, we need to get rid of anonymity inside our infrastructure. Every server, laptop, cloud account, human and AI agents must have a unique, cryptographically bound identity that is issued from a single source of truth, which is managed consistently across all environments.
We need to give every user in our infrastructure – human or machine – a hardware-backed birth certificate, essentially. And the good news is that this already exists, because we already have the ability to derive identity from a private key stored in a protected chip: for laptops, it’s Trusted Platform Module, while for servers, it’s Hardware Security Module, and so on. From there, cryptographic authentication replaces static credentials. Stealing a password becomes irrelevant because there’s nothing left to steal.
A unified and cryptographic identity layer might not kill complexity outright, but it will at least remove the invisible borders that exist between all the platforms that engineers use. It will make modern security investigations far less painful. We should never need eleven tools to piece together a single security incident – or five different zero-trust frameworks to cover five kinds of users.
If we redefine identity as something that cannot be stolen, only verified, then we might finally have a model that scales with the world we’ve built – a world of AI agents, distributed systems, global infrastructure, and so on.
Borders might make sense for nations, but they don’t for technology.
