Orchid Security has announced identity drift detection and application-level kill switches for AI agents. They can complete authorized objectives beyond their initial privilege level within seconds. AI agents do not need to “break” security controls or workflow guardrails.
AI agents can find and use the identity debt already embedded across the enterprise: hard-coded credentials, orphaned accounts, unmanaged authentication paths and excessive permissions. The new AI readiness controls help enterprises scale AI adoption without losing control.
AI adoption is now a board mandate
Boards have moved from asking whether their companies should adopt AI to asking how quickly they can scale it. Resisting is no longer a viable security posture. What enterprises need is a defensible plan that enables adoption while keeping autonomous agents inside authorized boundaries.
“AI transformation is exciting. Identity hygiene is not,” said Roy Katmor, CEO of Orchid Security. “Boards are no longer asking whether AI will be adopted—they are asking why it is not moving faster, and security cannot answer with a blanket ‘no.’ Enterprises need to observe how agents act, understand when they drift, and govern them immediately, including terminating the authority through which they operate.”
The obstacle is not agent behavior. It is what agents inherit. Agents do not need to break security controls to exceed their intended scope—they find and use the identity debt already embedded across the enterprise: hard-coded credentials, orphaned accounts, unmanaged authentication paths, and excessive permissions. Orchid’s Identity Gap 2026 found that 57% of enterprise identity is unseen and unmanaged. Agents can turn that identity dark matter into an active path to elevated access in seconds to minutes—far faster than periodic governance reviews can detect or contain it.
An operational framework for agent adoption: Observe→ Understand→ Govern→ Prove
Orchid enables continuous, auditable AI-Readiness and defensibility:
- OBSERVE: Discover AI agents and the identities, applications, credentials, tools, and access paths through which they operate. Continuously capture actual behavior, not only what was configured in the studio.
- UNDERSTAND: Compare runtime behavior with the agent’s original purpose and authorized scope. Orchid applies readiness tags to applications, accounts and access paths, exposing identity hygiene gaps, excessive permissions and environments that are not yet safe for agentic access.
- GOVERN: When behavior or effective authority drifts beyond policy, Orchid orchestrates action through the organization’s existing identity, security and AI infrastructure. Actions can include reducing permissions, revoking credentials, disconnecting tools, suspending workflows or uniquely activating its own application-level kill-switch.
- PROVE: Orchid generates a defensible audit trail linking each agent action to the identity used, delegation chain, access path, business context, detected drift and resulting governance response.
What enterprises should be able to demonstrate
Before autonomous agents are deployed at scale:
- Identity hygiene: Every orphaned, dormant, local, and over-privileged account is identified and assigned a readiness status.
- Authorization guardrails: The organization can determine who or what may act, on whose behalf, for what purpose, and under what conditions.
- Runtime understanding: Actual agent behavior can be compared continuously against approved intent, permissions, and expected access paths.
- Universal auditability: Every action can be attributed to an identity, delegation chain, application, access path, and business context.
- Enforceable response: The enterprise can immediately restrict or terminate the authority a drifting agent operates through.
Regulators are converging on the same requirements. NIST’s draft Cyber AI Profile notes that “regardless of where organizations are on their AI journey, their cybersecurity programs need risk management approaches that support and integrate the realities of advancements in AI.” In Europe, DORA obliges financial entities to demonstrate control over ICT access and third-party dependencies, an obligation that does not pause because the entity acting is an agent rather than a person.
Availability
Following the recent agentic enhancements to Orchid’s Identity Control Plane in May, the capabilities below are now available:
- AI readiness tagging across applications, identities, and access paths
- Identity hygiene and security risk findings for orphaned, dormant, over-permissioned, and suspicious accounts
- Continuous drift detection between an agent’s intended purpose and observed behavior
- Orchestrated response, including application-level kill switches that restrict permissions, revoke credentials, disconnect tools, or suspend agent workflows
- Audit generation documenting agent activity, identity context, detected drift, and the response
Orchid has also expanded its integration ecosystem:
- Palo Alto Networks Idira: A certified PAM integration that discovers privileged accounts not previously known to Idira and brings them under management.
- Splunk Enterprise Security: A prebuilt integration that streams identity telemetry to the SOC for correlation, investigation, and incident response.
Shannon Wilkinson, CIO and CISO at Findlay Automotive Group, described the tension from the practitioner’s seat: “The challenge is how to enable the business to move faster and realize the productivity that AI agents bring, but it honestly terrifies a lot of us. At Findlay we’re leaning heavily into AI to build a better customer experience. At the same time we must define guidelines, put guardrails in place and, above all, know what the identities are doing.”
Enterprises have ignored identity dark matter in general, and poor identity hygiene specifically, for a long time now- which is one of the reasons that threat actors are more likely to log in than hack in today. But exposing AI agents to all the identity clutter that has accumulated over time is a recipe for disaster.
