Why Identity Is Becoming Security's New Front Line

Security teams around the world have always tried to play a balancing act when it comes to authentication. If there are too many measures put in place, people will always find a way to get through it. In the world of rapid AI advancement, this balancing act is proving to be more difficult for organisations. The reason is that AI agents proliferate; they're now able to perform tasks on behalf of employees and customers without a human overseeing every action. So what needs to be done to prevent your organisation from being exposed? 

On this episode of the Security Strategist Podcast, host Trisha Pillay talks with Dan Moore, Senior Director of CIAM Strategy and Identity Standards at FusionAuth, about how and why identity has become the new security perimeter.  Moore has worked for almost six years at FusionAuth, starting in developer relations before stints in sales engineering and implementation prior to his current role. At FusionAuth, he helps track standards bodies like the IETF and OpenID Foundation and determines which fledgling methods are ready for adoption into the product. 

The Security-Usability Tension Gets Sharper

Finding the right balance between strong security and a smooth user experience is a challenge organisations have faced for years. Moore traces it back to the invention of the first password field in the 1960s. Various industries have adopted different approaches to ensure that there is a balancing act of strong security and a smooth user experience for their customers. For example, banks are willing to require more security checks than a consumer app because the risks are so much higher. 

The old methods of authentication were designed for a world where every login belonged to a person making decisions at human speed. This has all changed now because of AI agents. Unlike people, AI agents can work independently, run continuously, and complete thousands of tasks in seconds. This speed and scale mean they can also cause far more damage in a matter of seconds if something goes wrong. AI agents need to work independently, so traditional human-focused security measures like MFA and CAPTCHAs often get in the way. It's also important to know that removing those checks doesn't just eliminate the security risks. This simply means those risks can happen so much faster. At the same time, asking humans to approve everything isn't a solution either, because people quickly become overwhelmed and stop paying attention.

Adaptive Authentication in Practice

This is where identity is shifting from a single check at the door towards continuous and contextual verification. Moore describes it as moving away from a binary model, because risk no longer lives only at the login screen. It follows the session, the device and the ongoing behaviour within an application. FusionAuth worked with a platform connecting caregivers with families needing support, a sector handling sensitive data including that of minors. By adding enterprise single sign-on and multi-factor authentication, the company cut its authentication development time by 90 per cent and opened up business markets it previously couldn't serve, proof, Moore says, that tighter security and a better user experience aren't mutually exclusive when the approach is intelligent about context.

Giving AI Agents Their Own Identity

One of the biggest shifts discussed is the need to stop thinking of AI agents as just another user account. Instead, organisations need to manage them as separate digital identities with their own permissions and controls. Moore recounts a colleague mentioning they would let an AI assistant drive their browser while logged in as themselves. This becomes indistinguishable, from the system's perspective, from the person acting directly. Without a separate identity, there's no way to apply different policy, add extra checks, or restrict what an agent can do relative to its human counterpart. With all that said, it's no wonder that AI agents need their own identities, provisioning, and scope, along with their own audit trail. The risk comes down to velocity. A compromised employee can only do so much before they're detected, but a misbehaving AI agent can make thousands of decisions, access systems, and execute actions in the same amount of time.

Moore frames trust as resting on three interlocking layers: identity validation, audit, and policy enforcement. Validation establishes who or what is acting; audit records what actually happened, which matters given how unpredictable agent behaviour can be; and policy enforcement, built on principles like least privilege and short-lived, task-scoped credentials, limits the damage if something goes wrong. All three layers work together to build trust, he says, because each one compensates for what the others struggle to catch alone.

His advice for organisations still finding their footing is to start small rather than wait for a polished strategy: inventory the AI agents and automated processes already running, note what kind of credentials they rely on, and begin shifting static API keys towards short-lived, standardised grants. Above all, he argues, AI identities deserve their own category tied to an accountable human or team, but never simply reused from existing human or service accounts. If you would like to find out more about this, visit  FusionAuth or connect with Moore on LinkedIn.

Takeaways

• The changing role of identity in security.
• Challenges of AI-powered applications and autonomous agents.
• Adaptive authentication and risk-based security.
• Building trust through identity validation, audit, and policy enforcement.
• Practical steps for organisations to enhance security in AI environments.