Adam Perks

🚨 Outnumbered and Overlooked: Securing Non-Human Identities in the Modern Enterprise As organisations embrace cloud, automation and AI, non-human identities (NHIs) such as service accounts, APIs, workloads and AI agents are rapidly becoming the backbone of the digital workforce. Yet many remain unmanaged, overprivileged and largely invisible to traditional security controls. Join 🎤 Derek Gordon, VP, Identity & Access Management Practice at NCC Group, as we explore: ✅ Why NHIs are one of the fastest-growing cyber risks ✅ The security challenges created by credential sprawl, weak ownership and excessive privileges ✅ Practical approaches to continuous discovery, real-time authorisation and observability ✅ How organisations can strengthen governance, accountability and trust across the digital workforce 💡 Learn how to gain visibility into your non-human identities, reduce risk, and secure the machine-to-machine ecosystem that powers modern business. 📅 Wednesday 7 October | 11am BST 💻 Online Webinar 🎟️ Free to attend – registration required 👉 Secure your place now: https://lnkd.in/eJcpAxq2 #CyberSecurity #IdentitySecurity #IAM #NonHumanIdentities #CloudSecurity #AI #CyberRisk #ZeroTrust #DigitalTrust #SASIGEvents

Have AI agents moved the identity gap? Yes. The question is no longer only who has access, but what is acting, on whose behalf, and with what authority. That was my takeaway from today's round table around the question: "What are the biggest identity security challenges and visibility gaps your organisation faces today — and has the arrival of AI agents and copilots changed where those gaps are?" My thanks to the organisation GDS Group and Meet the Boss, and to my fellow participants Andrew Bushby, Teddy Ramanakasina, Francis McConnell, Vijay Madan, Jay Ogunpehin for sharing practical experiences, challenges, and diverse perspectives. Some of the key themes we explored included: → A global AI taxonomy — we still use "agent", "model" and "AI system" to mean different things → Continuous discovery of agents, models, services and third parties → Data governance: quality, ownership, lineage, access rights and evidence → IAM, IGA, PAM and UEBA converging to cover machines and agents → Ownership, accountability, delegated authority and decision rights → AI third-party risk management → Containment beyond the kill switch: pausing an agent, revoking its authority and remediating its actions are distinct controls → Awareness and training The point I was most pleased to bring: many organisations have controls, policies and frameworks, yet lack an AI Governance Operating Model — one system joining governance, identity, security, risk, compliance, data, technology and business accountability, and turning each principle into action, evidence, metrics and decisions. Frameworks are the language; the operating model is the work. Two principles I keep returning to: → We cannot deterministically control what an agent intends to do, but we can deterministically control what it is authorised to access, modify, approve, execute or disclose. → If I had to choose one control to implement from tomorrow: no agent acts using another person's credentials. Agents must never know a user's password, token or secret — they act under their own identity, with task-scoped delegated authority. One point that deserves more attention: more centralised approvals do not resolve the tension between speed and control — either the business circumvents them, or governance becomes the bottleneck. Governance must be built into the delivery pipeline:  → Risk-based segmentation — sensitivity sets who can see; reversibility sets how far an agent can act alone. The harder an action is to undo, the less autonomy an agent should have and the more explicit the authorisation should be. → Pre-approved workflows — templates, connectors, managed identities, logging and testing by default. → Controls as code — no owner, borrowed credentials, hard-coded secrets or unapproved APIs? The pipeline stops the agent before production. I would welcome continuing the conversation. Where is your organisation drawing the line between what an agent may attempt and what it may do?

📰 we are Launching something NEW TODAY 🚨 Soft Plush toys, Pokémon, and PS5?!?! - Take the ControlUp Challenge - Value, Savings and ROI in 7 days!!! ⬇️ plus My Friday follow recommendations on LinkedIn this week.... ⬇️ Tim McCormack at Gartner - DEXpert and analyst Steve Tolton - my rock and marketing coach who happens to own the coolest design and event agency I have worked with for almost 10 years #Disrupt #NowAndNext #BeyondExperience Daniel Moss- technically and commercially astute Seller in the world of AI agent security who regularly posts insights on LI David Shepherd - long-standing friend and sales leader at Ivanti Dan O'Shaughnessy - left the world of IT and now runs indoor golf venues in UK Sheila Hatch - Owner and creative director for Decca Design in US who never fails to deliver And the ControlUp Rockstars this week include... Daniel Bergemann Kara Schmidt Carolin Hebenstreit Benjamin Skoda Joel Stocker Blair Kantolinna Joe S. ControlUp #DEX #DLM #SAM #ISTM

Most conversations about AI agents start with what they can do. The more useful question is who is accountable when they do it. In some organisations, machine identities now outnumber human ones by more than 40 to 1. Agents can also run within an employee’s own session, using that employee’s credentials. So, if something goes wrong, there is no clean way to prove whether the employee took the action or the agent acted on their behalf. My answer hasn’t changed since I started raising this with customers: treat every agent like a new hire. Give it a name, an owner, and only the access that day’s task needs. Nothing sits there once the job is done. https://lnkd.in/dv-2v2C4 #identitysecurity #agenticAI #delinea #ArtificialIntelligence #GISEC2026 #PrivilegedAccessManagement #leadership #zerotrust

Most identity security tools do one of two things with AI agents: • Verify the connection when a session opens — then audit or revoke access after something's already happened. • Monitor traffic that happens to pass through their own server — blind to anything that connects directly. Neither approach actually governs what the agent does once it's in. That's a real problem when the "user" is an autonomous agent capable of running commands across production databases, SSH hosts, Kubernetes clusters, and cloud consoles — at machine speed, with no human in the loop to catch a bad action before it happens. Delinea's new runtime authorisation capability changes that. It enforces policy on agent actions in real time, inside the session, before execution — across every protocol agents actually use. Credential hiding was never going to be enough. Governing the connection was never going to be enough. It's time to govern the action. #AIAgents #ZeroTrust #IdentitySecurity #Delinea

Huge shoutout to Frank Vukovits, CISA, CIA for an outstanding session yesterday at the Gartner Security & Risk Management Summit. “A Zero Trust Approach for Securing Agentic AI - Discovery to Control” 160+ security leaders pack the floor- standing room only - for a genuinely thought-provoking look at one of the most urgent challenges facing security teams today: how do you apply Zero Trust principles to AI agents that act autonomously, make decisions, and access systems on their own? 🎯Frank broke down the discovery-to-control journey in a way that resonated. The many conversations that followed say it all - this is top of mind for every CISO and security architect wrestling with how to keep pace with AI adoption without losing control of their environment. Proud to be part of a team pushing the conversation forward on securing the next generation of identities - human and machine alike. Great work, Frank! 👏🏼 #GartnerSRM #ZeroTrust #AgenticAI #CyberSecurity #IdentitySecurity #Delinea

Last week I passed my 10 years milestone at Softcat.   During that time, I've had the privilege of working across technologies, teams, vendors, customers, propositions, and helping people navigate to a rapidly evolving industry.   What I'm most grateful for isn't the time itself, it's the connection with people. I've been incredibly fortunate to work alongside brilliant colleagues, learn from great leaders, and most importantly, help talented people grow, succeed and realise their potential.   The ‘vintage’ Softcat I joined in 2016 is very different to the Softcat of today. And the Softcat of 2036 will likely look different again. However, one Softcat habit will always remain: creating opportunities for people to learn, grow and make an impact.   As we continue to evolve, expand internationally, and create new opportunities for our people and customers, I'm excited to be part of the next chapter.   Thanks to everyone I've had the privilege of working with over the last 10 years and the Softcat culture you all contribute towards.   Now, onto the next 10. Softcat #Softcat #Leadership #Technology #Growth #Culture

We’re growing, and so is our leadership team. Tim Regan joins Delinea as Chief Financial Officer, bringing deep experience scaling technology companies as we continue building for what’s next. Welcome to Delinea, Tim. 👋 Get the details: https://bit.ly/3Vaxlh1