In an era where enterprises are juggling a messy patchwork of SaaS applications, cloud infrastructure, and legacy on-premises systems, identity management has become the Achilles’ heel of modern cybersecurity. Jim Alkove, co-founder and CEO of Oleria, warns that current identity architectures�designed for the simpler realities of five to ten years ago�are fundamentally unprepared for today’s explosive fragmentation and scale. With organizations now managing non-human identity ratios as high as 80:1 compared to human users, security teams find themselves in perpetual catch-up mode, relying on risky manual processes that simply can’t keep pace with the volume and velocity of modern digital transformation.
The problem is about to get exponentially worse with the emergence of agentic AI. Unlike traditional automation, AI agents can autonomously reason about problems and dynamically determine what access they need to solve them�creating unprecedented challenges for identity systems built around predictable, pre-defined permissions. Alkove, drawing from insights gathered through a SINET working group of CISOs managing some of the world’s most complex environments, argues that organizations can no longer afford to simply adapt their existing approaches. Instead, they need identity architectures built from the ground up for this new reality, where AI agents work in concert with each other and human processes become the critical failure points in an increasingly automated world.
++
VMblog: Your guide states that “current identity architectures were never designed for today’s scale and complexity.” What are you seeing in enterprise environments today that makes this so clear?
Jim Alkove: The short answer is: the way we’ve been managing identity in today’s environment just does not match the reality of what is needed to achieve secure business outcomes. It’s not that the tools or approaches are bad – it’s just that, at best, they were developed for the reality of five or 10 years ago, and the fragmentation has just exploded since then. Most organizations are dealing with this messy patchwork of SaaS apps, cloud infrastructure, and on-premises systems – each with its own identity model. That fragmentation creates huge blind spots and risks. And then you pile on the explosion of non-human identities, and you start to understand why identity and security teams are drowning. I’ve seen ratios as high as 80:1 for NHIs compared to human users.
Of course, people will say, “We’ve been through big tech transformations before. We can just adapt what we’re doing to fit what’s changing.” But – and I know it’s clich� to say – the speed and scale of that change today is just too much for adaptations to keep pace. Companies are stuck in catch-up mode with identity and access, and that puts a drag on productivity and collaboration, and it slows their ability to innovate. The other big problem is that all those adaptations end up relying on manual processes as the glue that holds them together – to look at data and alerts across systems, to correlate events, to enforce consistent policies – and the truth is that manual processes will always be risky fail points. As the volume and speed keeps going up, human processes move too slowly, and people make mistakes.
That’s why, when we pulled together the SINET working group, there was instant agreement: you can’t just tweak what you’ve got. We need an identity architecture built for this level of scale and complexity from the ground up.
VMblog: You’ve said “the oncoming wave of agentic AI will completely overwhelm conventional approaches.” How is managing AI agent identities really different from managing human or device identities?
Alkove: AI agents change the game. But not because they can read, write, move, or delete data; execute workflows – we’ve had automation that can do these things for years now. What makes agentic AI different is its ability to autonomously reason about the best way to solve a problem – and simultaneously do the work to solve that problem. That means that you can’t always predict what access the AI agent needs to do its job ahead of time. Your identity system needs to be dynamically adaptive – granting just the right access at just the right time – while still having strong technical guard rails to prevent AI from far exceeding its authority.
And it’s not just one agent at a time. These agents will work in concert with one another, which means we now not only have to solve delegation and impersonation (areas where current systems still fall short), but also identity composition – where multiple identities are involved in the same transaction or workflow. That’s a totally different risk profile.
The thing is, a lot of people still think I’m talking three, four, five years into the future. I’m not. This is already happening – in your organization. And if you’re not already closing your non-human identity blind spots and thinking about AI agent lifecycle management, you’re already starting to lose control – and you’re going to be way behind when the agentic AI wave really hits.
VMblog: This guide was built with input from CISOs managing some of the most complex environments in the world. How did that change the recommendations compared to a typical vendor- or research-driven framework?
Alkove: I’ll tell you what used to drive me nuts about the typical analyst frameworks and vendor “guides”: they just don’t hold up when you’re in the trenches. The analyst stuff often reads like it was written from 30,000 feet for someone trying to understand that market rather than someone who is charged with enabling critical business initiatives that span multiple SaaS and on-premise systems in a sensitive regulated business. And we all know how vendor content conveniently leads to “you should buy our solution” – whether or not that solves your actual problem.
When you’ve actually run security in a large enterprise, you know the reality: you can’t wipe the slate clean. You can’t magically get rid of your tech debt and consolidate onto one identity system. You are stuck with a patchwork of tools, decades of legacy, finite budget, and a team that’s already stretched thin. That’s the world I’ve lived in, it’s the world the other CISOs and security leaders in the SINET Identity Working Group have lived in – and we wanted this guide to help people who live in that world get to a better place in a concrete way. We wanted to build the kind of resource we would want. It’s about unifying and orchestrating what you already have to get to a stronger, more mature state – not chasing a mythical “single identity platform” that only exists in marketing decks.
VMblog: For a CISO who recognizes they’re in that fragmented, reactive state you describe – what’s step one?
Alkove: Step one is getting your arms around what you’ve actually got. I don’t just mean your workforce directory – I mean every human, non-human, and AI identity across SaaS, cloud, and on-prem. And not just the accounts, but exactly what those accounts can and did touch.
From there, knock out the big, easy wins first: fix weak MFA coverage. Get rid of dormant accounts and groups. Take a brutally honest axe to excessive privileges. Do the same for external accounts and externally shared resources. Then start using that consolidated view of identity to find the patterns and risks that are invisible when your data is scattered.
I know you asked about step one, but I want to make sure people understand this isn’t just a smarter way to do the same kind of reactive firefighting. The really big step forward comes when you can use that unified view of identity to start moving toward consistent, automated policy enforcement. That’s when you start feeling the weight lift.
VMblog: You talk about turning identity from a bottleneck into a strategic enabler. What does that look like in practice?
Alkove: When identity is working the way it should, it’s not just about stopping bad things – it’s about letting the business move faster while limiting risk to an acceptable level. A really hot topic right now is, of course, how to accelerate AI deployment. All of the identity technology required to fully enable agentic AI at scale doesn’t exist today. However, if your identity foundation is strong and unified, your organization can get moving with AI today and keep risk in check. But let’s set the AI hype aside – a stronger identity program can accelerate some more fundamental business strategies, too. Let’s say you want to spin up a new partner integration – or even merge with another company. Instead of doing weeks of manual provisioning and access clean-up, if you have a unified, policy-driven identity foundation that we’re talking about, you can establish trust and enforce consistent controls from day one – so people can start collaborating securely right away.
We can talk about how this leads to improved security metrics – things like faster provisioning times, quicker incident containment, fewer manual approvals – and there is real value there. But the nonlinear benefit is cultural: It happens when your business units start to see security as the team that makes things possible instead of the team that slows them down. That’s a really profound shift that’s been a long time coming.
VMblog: Without revealing the whole blueprint, what was the biggest “aha” moment in designing the unified identity and access system architecture?
Alkove: Honestly, one “aha” was watching a group of very experienced CISOs all agree that the “just adapt what we’ve got” approach is done. That was a big moment.
The other “aha” was realizing that the approach we were taking – building AI managed access on top of a strong data foundation – wasn’t just going to change the game for managing access for existing systems. It was also the 100x unlock for orchestrating access for agentic AI.
Over my long career there have been a few moments when things just clicked and you knew that an approach was just right. This was one of them. All of this won’t be built in a day. But if we continue to work as a community, we can ensure it evolves in the direction and at the velocity that operators need – and build the kind of adaptive, autonomous and AI-ready identity system that I believe will drive lasting change and put today’s identity struggles in the past.
##
