Identity-based attacks now account for 90% of breaches — and the environments those attacks cross have outpaced the tools most security teams have in place. A SIEM ingests logs. An IAM manages human provisioning. A CASB monitors sanctioned SaaS usage. None of them was designed to follow a stolen OAuth token as it moves across an authentication boundary from a SaaS IdP into IaaS infrastructure and back into another SaaS application. That architectural gap is the story behind Salesloft, Snowflake, and Okta. This guide covers how to close it — across every identity type and every environment your organization runs.

Why traditional identity tools create blind spots, not coverage

The challenge with identity security in 2025 isn't a shortage of tools — it's the gaps between them. Most organizations run a SIEM for event logging, an IAM for human provisioning, a CASB for sanctioned SaaS monitoring, and a CSPM for cloud resource misconfiguration detection. Each tool was designed for a specific layer, and identity attacks consistently exploit the space between those layers.

The Snowflake breach — 165 customer environments compromised through infostealer-harvested credentials — succeeded because accounts lacked MFA and had not rotated credentials in years. The monitoring in place didn't flag credential reuse at the scale it was being exploited. The Salesloft/Drift attack was more complex: attackers compromised Salesloft's GitHub, extracted Drift OAuth tokens, and pivoted into Salesforce instances across 700+ organizations. Each step crossed an authentication boundary. Each boundary was managed by a different tool. No single system had the context to connect them.

The root cause is architectural. Identity behavior doesn't stay within tool boundaries. Attackers know this. Effective identity security programs need to know it too.

The non-human identity challenge security programs consistently underweigh

Most identity security programs were designed around human users: provisioning, deprovisioning, access reviews, MFA enforcement. The problem is that human identities are no longer the majority of the attack surface.

Organizations now manage 50 times more non-human identities — service accounts, API keys, OAuth tokens, and secrets — than human employees. These identities were built for automation and speed, not for the security controls designed around human behavior. They rarely have MFA enforced, they accumulate permissions over time without scheduled review, and they span multiple environments without a single owner accountable for their lifecycle. 67% of organizations have more than 10,000 zombie accounts, and stale service accounts are involved in 35% of insider threat incidents.

The assessment gap compounds the exposure. Traditional IAM systems were built for point-in-time access reviews of human users. Dynamic, cloud-native non-human identities that spin up, acquire permissions, and persist across environment boundaries require continuous discovery and behavioral monitoring — not annual access reviews conducted in a spreadsheet. 

Securing AI identities before the attack surface expands again

The 2026 Permiso Security State of Identity Security Report found that 91% of organizations expect AI-generated identities to increase, with one in four predicting they will double or triple. Most security teams still cannot account for the AI-created identities already active in their environments.

AI identities break into three categories with distinct risk profiles. AI users are employees accessing tools like ChatGPT, Copilot, or Claude — often through personal accounts that bypass corporate authentication controls and data governance policies entirely. AI builders are developers creating and deploying AI applications, where API key exposure in code repositories and ungoverned model access create both credential and data leakage risk. AI agents are the most complex: autonomous systems that frequently inherit excessive permissions from their human creators and operate at machine speed — faster than traditional monitoring pipelines can track.

The practical response requires extending the same runtime intelligence applied to human and non-human identities to this new category: discovering which AI services are connected to corporate systems, mapping AI agent permissions and data access patterns, and establishing behavioral baselines that make anomalous AI agent activity detectable before it produces an incident. 

Ready to secure your identities?

DOWNLOAD THE GUIDE