Clément Notin
Clément Notin is a Staff Security Researcher at Tenable dedicated to dismantling identity-based risks. Drawing on ten years of experience in offensive security, ranging from boutique consulting to securing global industrial infrastructure, Clément now focuses on identifying systemic weaknesses in Entra ID, Okta, and Active Directory. His research helps bridge the gap between legacy identity management and modern cloud security, providing actionable insights for the world's most complex environments.
Session
The rapid adoption of autonomous AI agents, driven by the alluring “song of the Siren”, raises many security questions, including: how should we handle the identity aspect of agentic AI?
When talking security wise, we like to think that AI Agents can be considered a type of cloud workload, which makes AI Agent Identities, a type of NHI (Non-Human Identity). While AI agent identities share some concerns with human identities (like least privilege), they are fundamentally more akin to NHIs due to their machine-driven, programmatic nature and potential for high-velocity, automated actions.
While there are a lot of NHI security solutions, in the fast-paced world of AI agents, it’s very easy to accidentally introduce misconfigurations, including in their attached identities who may be over-privileged. Furthermore, the rapid, sometimes unsanctioned, proliferation of these agents introduces a "shadow AI" problem, where ungoverned agents become "out of control" security risks.
This raises the need for identity solutions custom tailored for agentic AI.
In this session, we venture into the “Abyssal Control Plane” to explore how AI agents function as a specialized, high-velocity breed of Non-Human Identity (NHI).
We will perform a technical teardown of the emerging identity models currently in the glow of the “neocloud”, specifically Microsoft Azure’s Entra Agent ID and Google Cloud Platform’s Vertex AI Agent Identities. Moving beyond the hype, we will map the "hidden rocks" of these preview implementations.
Whether you are securing your CSP, IdP, or SaaS ecosystem, this talk provides the coordinates needed to ensure your organization’s shift toward agentic AI doesn't founder on the hidden “reefs” of ungoverned permissions sprawl and identity drift.