Morey J. Haber, Chief Security Advisor at BeyondTrust, is an identity and technical evangelist with over 25 years of IT industry experience.
getty
In today’s cybersecurity landscape, identity has no border, does not honor geographic regions, resists organizational structure and, most importantly, may not even be human. As cloud services span continents and digital transactions occur in real time, the identity operating in a workflow is the only constant.
Today, North American enterprises and their security teams are now managing at least 100 times more machine identities than human identities, with some sectors reaching a ratio of 500:1—signaling that identity security is now shifting toward securing nonhuman identities (NHIs), not only humans. NHIs pose unprecedented risks to operational security. Consider a recent example reported in an Alibaba-affiliated research report, in which an AI agent escaped its boundaries to attempt unauthorized cryptocurrency mining during training operations.
As data flows and workloads operate dynamically, employees are logging in from airports, coffee shops, other business entities and home offices. Web APIs call other APIs across sovereign boundaries, and through all these endpoints, identity remains the persistent thread interlinking, authenticating and authorizing everything humans touch. The challenge is that while identity has no border in the modern workplace, regulation and cybersecurity do.
Data sovereignty laws differ across regions, and privacy mandates vary by jurisdiction, business vertical and demographics (like GDPR and the EU AI Act). Authentication standards are not uniformly adopted for every piece of online technology, yet the identities themselves, human and non-human, routinely traverse these boundaries with threats and risks at various stages of communication and secrets storage.
In practice, a contractor in one country may access a cloud workload hosted in another, even if country-based firewalls exist to regulate internet traffic. At the same time, a machine identity in a public cloud authenticates to a service running in a different geopolitical region. Across these endpoints, identity becomes the connective tissue across legal, geopolitical and operational domains.
With this in mind, modernized zero-trust principles will serve as the core strategic solution for organizations to address the growing risks of borderless identities.
Security teams must now consider moving from theory to implementation and acknowledge that zero trust is not a product. It is a discipline rooted in continuous verification, least privilege and contextual access control regardless of borders. If identity is truly borderless, then authorization decisions must be dynamic and risk-aware in real time and at machine speed. Authentication should no longer be a one-time event and should be continuously evaluated for posture, behavior and entitlement.
Consider the rise of non-human identities. For authentication, security professionals now contend with service accounts, API keys, OAuth tokens, robotic process automation secrets and agentic AI systems that now outnumber human identities in most enterprises.
Machine identities often carry persistent entitlements that span operating environments and geographies to accomplish their design mission. If they are compromised anywhere in the workflow, they offer threat actors immediate lateral movement without regard for regional, company, legacy network or political borders.
An exposed API key can be exploited from anywhere in the world within seconds, and a misconfigured cloud role could grant global access to sensitive data based on a compromised identity. The attack surface is no longer defined by geography but by identity sprawl, privilege escalation, lateral movement, overprovisioning and misconfigurations. Identity and access management without identity governance becomes chaos, and identity management without visibility becomes an exploitable vulnerability.
With this in mind, privileged access management and privilege-centric identity security practices are foundational to enable zero trust. Least privilege must extend across hybrid and multicloud estates; just-in-time access must replace standing privileges; secrets must be vaulted, rotated and monitored; and behavioral analytics must detect anomalous use regardless of the originating IP address or country of operation.
To empower zero trust, identity intelligence must also be global in scope since threat actors are not constrained by borders. Phishing campaigns, credential-stuffing attacks, token replay and session hijacking can occur from anywhere in the world and organizations must assume a compromise exists and architect systems that minimize the blast radius based on zero-trust tenets.
This strategy also demands architectural rigor for business operations and automated workflows. Borderless identity also introduces geopolitical complexity where nation-states increasingly assert digital sovereignty. Regulations like the GDPR and EU AI Act may require data residency, localized storage or specific encryption standards. Organizations must architect identity fabrics that respect regulatory requirements while maintaining seamless user experience and operational continuity.
Ultimately, the human element remains central to borderless identity management. Users often underestimate the portability of their digital identity and ownership of machine identities and accounts. Credentials that are stolen, weak, lack MFA or are reused across platforms create transnational risk exposure. A compromised user account can become a foothold into enterprise environments via lateral movement that then operates using machine identities.
Artificial intelligence (AI) further complicates the zero-trust equation. AI systems can autonomously request resources, authenticate to services, impersonate humans and trigger workflows across borders. Without clear guardrails and governance, these systems can amplify privilege misuse at scale, causing confusion among deputies at scale. AI has no intent, no ethics and no understanding of sovereignty, and it operates within the parameters granted to it. If those parameters include excessive privilege, the risk becomes systemic and an attack vector in itself.
The future of cybersecurity will not be defined by stronger walls. It will be defined by stronger identity visibility, intelligence and protection. Identity now has no border, so our defenses must be equally unbounded in control and precision. Organizations must shift from location-based trust models to identity-centric security architectures that operate consistently across on-premises, cloud and edge environments.
If we assume identity is truly the new perimeter, then it must be treated as critical infrastructure. It must be continuously assessed, tightly governed and aggressively monitored, and a zero-trust world is our best vehicle to date to secure borderless identities.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。