Episode Details

The convergence of fragmented identity data and accelerating AI agent deployment creates a distinctive set of pressures for security leaders in Southeast Asia and Hong Kong. Regional research reveals that while agentic AI adoption outpaces resilience planning, only 34% of organisations have extended resilience planning to non-human identities—with Hong Kong showing particularly acute gaps at 23%. 

Singapore faces parallel pressures: 95% of organisations report feeling pressured to loosen identity controls for AI, while only 14% can always explain why an AI agent took a privileged action. Meanwhile, Hong Kong’s financial regulators are actively piloting “Know Your Agent” frameworks for payment workflows, signalling a regulatory trajectory that will reshape compliance expectations. 

Recognising that non-human identities are proliferating much faster as organisations deploy AI agents into their workflow, a recurring and in my opinion expanding challenge for CISOs and CIOs is how to turn fragmented identity data into actionable privilege‑path intelligence for AI agents.

I recently had the opportunity to speak to James Maude, Field Chief Technology Officer at BeyondTrust, for his perspective on the topic.

1.       Before we head straight into our topic, I wanted to get your perspective on something I have been observing for more than 10 years now. The cybersecurity tech stack continues to grow in complexity with the proliferation of best-of-breed standalone security tools. Since 2021 however, we’ve seen an aggressive consolidation. What is your take on this? 

2.       Music to the ears of the CFO I am sure. Anyway, From your observation, what is the true scope of non-human identity proliferation across organisations’ environments in Asia, and how confident are CISOs in the completeness of that picture?

3.       How do you see enterprises, and their CISOs, governing the privilege paths that connect AI agents to critical assets? (working and not working well) 

4.       When an AI agent takes a privileged action, is it possible to reconstruct the full chain of authority that permitted it in the first place? 

5.       If an AI agent is compromised or behaves unexpectedly, can you suggest performing containment and recovery strategies (best practice) that have proven to be effective? In this context, what won’t work and why?

6.       How should CISOs balance the business pressure to grant AI agents broad access for productivity against the principle of least privilege?

7.       How should CISOs align with emerging regulatory expectations for agent identity governance across the jurisdictions they operate in?

8.       What is privilege-path risk and what metrics should CISOs use to demonstrate that privilege-path risk is shrinking (which is good), not just being monitored?

9.       Who owns AI agent identity risk at organisations in Asia—and is that ownership sustainable across the silos where agents operate?

10.   2027, advise for CISOs and CIOs? What should worry them as enter 2027?