Cybersecurity Leaders Propose Treating AI as Identity at RSA Conference

SAN FRANCISCO — Cybersecurity industry leaders and artificial intelligence experts gathered at the RSA Conference on Thursday to address a critical shift in digital defense: the need to treat autonomous AI agents as distinct identities within existing security frameworks.

The discussion, held at the Moscone Center, centered on the rapid evolution of agentic AI and the emerging threats posed by autonomous systems capable of executing attacks without human intervention. Practitioners, vendors, and investors argued that traditional perimeter-based security models are insufficient against AI agents that can operate independently across networks.

"We are moving into an era where software agents act with autonomy," said one industry veteran during a panel session. "If we do not assign these agents a digital identity, we cannot manage their access or detect when they go rogue."

The proposed framework suggests integrating AI agents into identity and access management (IAM) systems. Under this model, every AI agent would require authentication, authorization, and continuous monitoring, similar to human employees. This approach aims to prevent unauthorized actions and limit the damage caused by compromised or malicious AI systems.

Experts highlighted the dual nature of agentic AI, noting that while these tools offer significant efficiency gains, they also introduce new attack vectors. Autonomous agents could potentially be weaponized to launch coordinated cyberattacks, scan for vulnerabilities, or manipulate data at speeds exceeding human capability.

"The risk is not just that AI makes mistakes," noted an AI security specialist. "The risk is that an AI agent, once compromised, can act as a persistent threat actor within a network."

The conference also addressed the challenges of implementing such a framework. Questions remain regarding how to verify the intent of an AI agent and how to distinguish between legitimate autonomous behavior and malicious activity. Vendors are currently developing tools to monitor AI agent behavior, but standardized protocols for AI identity management have yet to be established.

Investors in the cybersecurity sector expressed cautious optimism, noting that the market for AI-specific security solutions is expected to grow significantly. However, they emphasized that regulatory clarity is needed to guide the development of these new defense strategies.

As the conference concluded, the cybersecurity community acknowledged that the integration of AI into identity frameworks is not a matter of if, but when. The industry faces the immediate challenge of updating security architectures to accommodate autonomous systems while preventing them from becoming the next generation of cyber threats.

The debate continues on how best to balance the deployment of agentic AI with robust security controls. Until standardized practices emerge, organizations must navigate a landscape where the line between tool and threat is increasingly blurred.