Palo Alto Networks CEO Nikesh Arora recently described a massive challenge facing the cybersecurity industry: approximately $1 trillion in global cybersecurity debt that needs to be modernized to defend against increasingly automated and AI-driven threats.
It’s a statement worth paying attention to.
After all, Palo Alto Networks has spent years building and selling many of the technologies enterprises use to defend themselves. When the CEO of one of the world’s largest cybersecurity companies says a significant portion of the industry’s existing security infrastructure needs to be modernized, he has a unique perspective on the problem.
And fundamentally, he’s right.
Cybersecurity technology has always had a shelf life. Firewalls evolve. Endpoint platforms get replaced. Authentication technologies change. Applications move from the data center to SaaS. Infrastructure moves from on-premises environments to the cloud. New threats emerge, and new detection and enforcement technologies are built to address them.
AI will accelerate that cycle even further.
But while security technology changes, there is one discipline that has demonstrated remarkable staying power across generations of enterprise computing: identity governance.
Long before we talked about Zero Trust, IAM, IGA, SaaS, cloud security or AI agents, organizations were already dealing with the fundamental questions of identity governance.
Identity Governance Has Been Here All Along
Who is this user? What role do they perform? What resources should that role be allowed to access? Who approved that access? And should they still have it?
Go back to the mainframe era and you’ll find these concepts embedded in security technologies such as IBM RACF and ACF2. Enterprises created identities, organized users into groups and roles, assigned permissions to resources and established controls over who could access critical systems.
The technology was different, but the governance problem was essentially the same.
As enterprise computing evolved, identity governance evolved with it. Mainframe security was joined by enterprise directories such as Active Directory, IAM platforms, cloud identity providers, SaaS applications and modern Identity Governance and Administration platforms.
Throughout all of those transitions, the enforcement technologies changed. The need to govern identity did not.
That distinction matters when organizations are deciding where to make cybersecurity investments intended to survive the next decade.
Governance Should Outlast the Enforcement Technology
A well-designed identity governance program shouldn’t be dependent upon a particular firewall, IAM platform, database, cloud provider or security appliance.
Governance establishes the rules around identity: what an identity is, what role it performs, what resources that role requires, who is accountable for the identity and whether its access remains appropriate.
The enforcement technology implements those decisions.
That enforcement technology should be replaceable.
An organization might replace its firewall. A database proxy might be upgraded. An application might move from the data center to the cloud. One IAM platform might eventually be replaced by another. New Policy Enforcement Points will undoubtedly emerge specifically for AI systems.
But the underlying governance requirement remains: only properly authorized identities should receive access to critical resources.
Separating governance from enforcement creates an architecture that can evolve. The enforcement layer can change as threats and technologies change while the organization’s identity, role, authorization and review model retains its value.
That’s one reason identity governance should be viewed differently from many other cybersecurity investments. It isn’t simply another defensive technology. It’s part of the foundation upon which those technologies can make access decisions.
AI Doesn’t Eliminate Identity — It Creates More of It
There is a tendency to talk about AI agents as though they introduce an entirely new security problem.
From an identity governance perspective, much of the problem is actually very familiar.
AI systems ultimately use identities to interact with enterprise resources. They operate through service accounts, application identities, workload identities, API credentials and other forms of non-human identities (NHI).
What sits behind the identity may be dramatically more sophisticated. An AI agent may be capable of making decisions and performing actions at a speed and scale that traditional automation never could.
But it still needs authorization to do something.
And that brings us directly back to identity governance.
The important questions remain remarkably familiar:
- What is this identity, and is it human or non-human?
- Who owns and is accountable for it?
- What role or function does it perform?
- What systems and data can it access?
- What privileges has it been granted?
- Does it still require those privileges?
- When was that access last reviewed?
- What risk does this identity represent?
AI hasn’t made identity governance obsolete. It has dramatically expanded the number and types of identities that need to be governed.
Bringing Non-Human Identities Into the Governance Model
This is where we believe identity governance needs to evolve for the AI era.
At YouAttest, we’re extending the same governance principles organizations have traditionally applied to employees, administrators and other human identities to service accounts, automation identities and emerging AI agents.
The first step is visibility. Organizations need to identify these non-human identities and understand what they are. But discovery alone isn’t governance. Organizations also need to establish ownership, understand privileges, examine credential status and periodically certify that the access remains appropriate.
YouAttest’s current NHI work already incorporates signals including managed-identity classification, credential status and expiration, owner presence, AI-agent classification heuristics and account recency.
We’re also expanding that model toward deeper risk analysis. That includes greater visibility into privilege exposure such as directory roles, powerful Graph API permissions, Azure RBAC assignments, consent grants and privileged-access status. The roadmap also identifies behavioral signals such as network origin, geography, credential-change events and deviations in sign-in or usage volume.
The goal isn’t to invent an entirely separate governance system for AI. It’s to extend good identity governance to every identity participating in the enterprise.
Identity Governance in Any Form or Shape
This is an important part of how we think about YouAttest.
Identity governance shouldn’t care whether the resource being governed was created thirty years ago or three weeks ago.
YouAttest can be used to attest access associated with mainframe roles, traditional on-premises IAM and directory roles, modern cloud IAM environments and siloed application resources. The same governance model can now be extended to service accounts and other non-human identities.
The systems are different. The identities are evolving. The enforcement mechanisms continue to change.
The governance principle remains remarkably consistent.
An identity should have access because that access is appropriate for its role, has been reviewed by an accountable party and can be demonstrated through evidence.
That was true in the mainframe era. It was true when Active Directory became the center of enterprise identity. It remained true as applications moved into the cloud.
And it will be true when an AI agent is the identity requesting access.
Invest for the Long Haul
Nikesh Arora’s $1 trillion cybersecurity-debt warning should cause security leaders to think carefully about the technologies they are investing in today.
Some of those technologies will inevitably be replaced. That’s the nature of cybersecurity.
The better architectural question may be: What should persist while everything else changes?
We believe identity governance is one of those investments.
From RACF and ACF2 to Active Directory and modern IAM. From on-premises applications to cloud services. From human users to service accounts and now AI agents.
The computing architecture keeps changing. The threats keep changing. And the enforcement technologies will continue to change with them.
But the fundamental requirement remains remarkably durable: know the identity, understand its role, authorize the appropriate access, regularly review that access and maintain evidence that it was properly governed.
That’s not cybersecurity debt. That’s a cybersecurity investment designed to retain its value.
Invest for the long haul. Invest in identity governance.
Learn more about YouAttest Non-Human Identity Governance: https://youattest.com/non-human-identity/
Know your identities™ with YouAttest, contact us: https://youattest.com/contact
- AI Agents Are Privileged Identities. Their Access Needs to Be Reviewed. - October 3, 2026
- AI Is the Unrealized Insider Threat: Why Enterprise AI Security Starts With Existing User Access - September 20, 2026
- The Service Account Wasn’t the Initial Breach. It Became Part of the Attack. - September 13, 2026
