AI Transformations and Identity Hygiene: Insights from Orchid Security
In the rapidly evolving landscape of technology, the integration of artificial intelligence (AI) into enterprise operations has garnered significant attention. Roy Katmor, the co-founder and CEO of Orchid Security, highlights a prominent concern facing organizations today: the distinction between the excitement surrounding AI transformation and the less appealing but equally crucial concept of identity hygiene. According to Katmor, the conversation among corporate boards has shifted from questioning whether AI will be adopted to demanding explanations for why its implementation is not occurring at a faster pace. He emphasizes that security teams can no longer respond with a simplistic "no" when it comes to the potential risks associated with AI integration.
As organizations embrace AI technologies, they must grapple with the complexities of monitoring and managing AI agents. Katmor asserts the necessity for enterprises to closely observe agent behavior, quickly identify any deviations from expected actions, and exercise appropriate governance over these agents. This includes the capacity to terminate the authority through which these AI agents operate when necessary.
At the heart of the challenge lies not solely in how AI agents behave, but rather in what they inherit during their operation. The issues that arise are not a result of malicious intent or deliberate circumvention of existing controls; instead, they stem from years of accumulated identity debt within organizations. This debt manifests in various forms, including embedded credentials that have long been ignored, accounts that have been abandoned, unmanaged authentication routes, and overly broad entitlements granted to users. As revealed by Orchid’s Identity Gap 2026 research, a staggering 57% of enterprise identity remains in an unseen and unmanaged category.
This "identity dark matter," as it is referred to, poses significant risks. AI agents can swiftly exploit this unmanaged identity space, transforming it into a pathway for elevated access in a matter of seconds or minutes. This rapid exploitation outpaces traditional periodic governance reviews that many organizations rely on, making it nearly impossible to contain the associated risks.
In light of these developments, governance frameworks are evolving from merely stating intent to providing tangible operational proof. Katmor points out that while board resolutions may approve the use of agentic AI, they offer little guidance to Chief Information Security Officers (CISOs) about the specific applications that an AI agent may safely interact with. Moreover, such resolutions do not clarify which service accounts hold standing privileges or whether delegation chains are robust enough to withstand scrutiny from regulatory authorities. Unfortunately, this gap between mandate and measurable control is often the very point at which many AI initiatives face roadblocks and hinder progress.
The need for effective governance structures is paramount as organizations move towards comprehensive AI adoption. To bridge this gap, enterprises must invest in more sophisticated identity and access management systems that can provide real-time insights into the behavior of AI agents. This includes implementing solutions that proactively address identity debt and unearth hidden vulnerabilities within their systems.
Furthermore, organizations must foster collaboration between their AI and security teams. By working together, these groups can develop a shared understanding of the risks associated with AI operations and create unified strategies to manage them. Continuous education and training for both AI developers and security personnel are also crucial to ensure that everyone involved is aware of the potential dangers and knows how to mitigate them effectively.
As AI integration continues to reshape enterprises across various sectors, the race is on to establish robust identity hygiene practices that can keep pace with this transformative technology. Roy Katmor’s insights serve as a reminder that in the excitement of AI advancement, organizations must not lose sight of the fundamental need for governance and security. Only through vigilant monitoring, rapid response capabilities, and collaborative efforts can companies harness the full potential of AI while safeguarding their digital assets and mitigating the looming risks associated with identity mismanagement. As the journey toward AI transformation unfolds, the focus must remain on creating an environment where both innovation and security can coexist harmoniously.