Technological evolution is often presented as a whirligig of furiously fast, nonstop change in the eternal battle for competitive advantage. In reality, change is often like dancing the Foxtrot: we go “slow-slow-quick-quick-slow”. Today after the transformative emergence of ChatGPT and then the stunning, surging progress of agentic AI, I believe we are entering a new stage of AI where we see less of a Wild West approach and can enjoy a more managed use of this extraordinary technology.
I say Wild West because, just as with the cloud a couple of decades ago, where everyone rushed to make use of the shiny new technology, AI mania is leading to significant challenges, but we are now seeing more mature thinking applied. With cloud, the excitement led to uncontrolled spending as cloud services and apps were ordered on credit cards, or AWS accounts were used to create new services. The result was, firstly, what we came to call ‘bill shock’ when the costs of all this activity became apparent and secondly, major challenges to established security practices caused by a new open architecture.
In AI this Wild West stage is taking the form of high spending on tokens: the atomic units used by AI models. And the response to that we are seeing today is what some call ‘tokenomics’: a model for establishing the true value of that spending. So the principles of FinOps frameworks are coming to the AI world and a very good thing that is too.
But secondly, and again the comparison with cloud is striking, we are also seeing awareness that, as with any disruptive technology, there is a concomitant threat to security and governance. And thankfully there are some responses to AI change that can defend the integrity of our assets and protect us all from harm.
Agents of change
One aspect of this that is very significant comes with the emergence of AI agents. Agentic AI depends on liberating armies of agents or bots to re-engineer processes and even create entirely new processes and workflows.
Agentic AI is so powerful that it is threatening to disintermediate familiar elements of the commercial landscape. You could imagine it flattening an old sector like insurance broking, for example, because the agents can do what humans have been doing for centuries, but at far greater speed and with greater control of detail, resulting in fewer errors, a better experience for customers and a far smaller cost model.
But there is a catch to agentic AI. That is, these agents depend on freedom to act. They examine data, applications and processes and then find a better way to operate. But those agents are so powerful that they often override security and governance too. Often they don’t know that they can potentially void a governance rule or lead to enormous software bill and they can go into areas where humans are often blocked.
A sense of identity
For decades now, identity has been the bedrock of security. We allocate certain privileges to certain people at certain times and then we take those privileges away or we add to them depending on roles, experience and so on. It’s hard enough in this co-creative world to manage identity-centric security because we all work with a vast range of people who may need access to our data and systems at certain times: regulators, auditors, outsourcers, temporary workers and so on. But with agentic AI we have created a vast increase in the identity population because nonhuman identities, or NHIs, are suddenly everywhere. In many organisations they already outnumber human identity by perhaps hundreds to one… and counting.
The challenge to CISOs today is to create an environment where NHIs are effectively managed and we regain control over what agents can do. This then is the new world we have entered into where the successful, responsible organisation reaps the benefits of AI without the risks of it to security and budgets. Smart companies now are pioneering this by embracing and extending identity management to encompass NHIs. This is the third age of AI and we need to make it work.
By Simon Gooch, Field CIO at Saviynt.
- Digital Strategy