Zero Trust and Identity Security Are Top of Mind Right Now

Small and mid‑sized organisations are suddenly feeling the pressure—not to react, but to prepare.

Over the past week, several key developments in digital identity, access management and zero trust have taken centre stage. From new collaborations securing AI rollout, to tools that expose internal risk, the theme is clear: identity is the new perimeter, and it's shifting fast.

What’s making headlines

1. Strengthening Zero Trust Across AI Environments

Zscaler has expanded its Zero Trust Exchange to secure interactions not just between users and apps, but among AI systems themselves. Their Project AI‑Guardian now maps identity context across AI agents, and enforces real‑time access policies at every point of AI interaction. It also stitches together partner tech—like AWS, OpenAI and Databricks—for unified threat context and control. This helps businesses avoid blind spots as AI capabilities and adoption scale rapidly. According to industry coverage, it’s designed to avoid security silos common in AI deployment.

Why this matters for you - As AI tools proliferate, attacks or misuse could spread at machine speed within systems. - Consistent controls across agents, users and data are critical—but hard to implement.

Practical next steps - Assess whether your current IAM tools can monitor non‑human identities like bots, APIs or AI agents. - Prioritise vendors offering integrated visibility and enforcement across human, machine and AI identities. - Push for real‑time monitoring and policy enforcement rather than periodic audits. - Document and continuously update who (or what) connects to AI systems and why.

2. Elevating Non‑Human Identity Governance

Another partnership news: Oasis Security is integrating with Zscaler to enable lifecycle governance of non‑human and agentic identities—from discovery through decommissioning—under a single Zero Trust umbrella. That means machine identities carrying credentials, tokens or access cards are managed like people, with policy‑driven control across the identity timeline.

Why this matters for you - If you’ve got automated workflows or machine accounts performing tasks, they need the same identity hygiene as human users. - Over‑permissioned, always‑on machine identities can become easy entry points for attackers.

Practical next steps - Perform an audit of service accounts, API keys, scripts, IoT devices and scheduled tasks in use. - Set defined provisioning and decommission procedures tied to projects or systems. - Enable monitoring of non‑human identity behaviour—e.g. usage times, access frequency, destinations. - Automate credential rotation for machine identities wherever possible.

3. Seeing Your Blast Radius: Lateral Movement Exposed

A new report from Zero Networks reveals that once inside, attackers can reach 80% of enterprise servers via lateral movement. They are launching a free ‘Breach Map’ tool that shows exactly how far attackers could roam inside your network before detection. The insight: identity‑aware Zero Trust segmentation matters more than ever.

Why this matters for you - Legacy network designs that trust internal traffic can let someone move unhindered after a breach. - Visualising internal risk lets leaders prioritise lockdown where it matters.

Practical next steps - Use internal mapping tools (like the offered Breach Map) to identify internal exposure paths. - Enforce micro‑segmentation: only trust and grant access to exactly what’s needed. - Monitor east‑west traffic continuously, not just north‑south or perimeter events. - Review and revise access policies when systems or roles change.

4. Public‑Sector AI at Risk, Secured by Design

Zscaler and AWS have launched a collaboration tailored to government, healthcare and education sectors to secure GenAI deployments. It embeds zero trust controls into AWS’s generative AI infrastructure, aimed at governments and public‑serving institutions that want to scale AI safely. This avoids retrofitting security after rollout.

Why this matters for you - Even outside public sector, regulated industries must embed security from day one when using cloud AI. - Production‑ready AI without baseline controls means missed accountability and compliance gaps.

Practical next steps - If considering AI pilots, insist on a built‑in security model, not a wrapped‑on accessory. - Use reference architectures that incorporate Zero Trust from infrastructure to application layer. - Collaborate with cloud and security partners to define secure AI deployment patterns. - Train your teams on how AI workflows introduce new identity and access risks.

5. AI Threats Demand a New Identity Strategy (from Gartner)

At the Gartner Security & Risk Management Summit, analysts outlined how AI introduction forces a rethink of IAM. Threat actors are exploiting AI app compromise, deepfakes and prompt injection. Analysts urge CISOs to adapt identities, policies and detection to this new breed of risk—not just patch infrastructure.

Why this matters for you - AI agents and deepfakes let threats masquerade more convincingly than ever before. - AI‑specific attacks like prompt injection evade traditional monitoring.

Practical next steps - Update incident‑response playbooks to include AI‑related attack vectors. - Train your team on AI manipulation tactics and detection. - Add contextual signal monitoring—like anomalous query patterns or output behaviour. - Build AI identity governance into your policies: who can prompt models, when, and how outputs are logged.

What This Means For Your Business

The world has changed: identity isn’t just usernames and passwords anymore. AI agents, service accounts, cloud apps and workflows all carry identity—and they need governance, visibility and control. Zero Trust has stepped up from network perimeters to internal bots, AI, workload segmentation and policy automation.

For small to mid‑sized organisations, the pace can feel overwhelming. Yet the path forward is practical:

• Start with a clear inventory of human and non‑human identities.
• Map your internal exposure zones so you know where attackers could go.
• Adopt tools that enforce policy continuously, inline and contextually—not in batches.
• Integrate IAM, AI safeguards, micro‑segmentation and behavioural monitoring into a coherent model.

The benefits are immediate: reduced breach impact, stronger compliance posture, smoother audits and less firefighting. You’ll be building resilience and trust—internally, with customers, and partners.

Above all, act now. Identity is now the frontier of business risk—and control.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.