Take a second. The trouble is, most of the risky decisions in your business happen faster than that

Cybersecurity Awareness Month asks Australians to take a second before clicking a link, sharing information or accepting a request that feels a little off. It's sound advice, and it works because one person can pause before they act. That pause is important because hackers and bad actors usually get into an account these days by compromising an identity.

It's no different for businesses. Attackers favour this route because it's quieter than forcing their way past a firewall and it lets them move through a system looking like they belong there. In fact, according to industry reports, identity has become the main attack vector for enterprises, with nearly 86 percent of breaches now involving identity compromise.

The difference is that businesses don't have the luxury of pausing the way an individual can. An organisation isn't making one decision at a time, it's making thousands of access decisions every day, across every employee, system and application it runs. Increasingly, a growing share of those decisions aren't being made by people at all. Non-human identities like service accounts and bots, and AI agents are now granted access constantly, often without a person reviewing the decision at any point. There's no equivalent moment to pause because there's no single person there to do the pausing.

We saw exactly what that looks like last month, when it emerged that an OpenAI research agent had gained unauthorised access to a Medicare statistics reporting portal, an incident Prime Minister Anthony Albanese later confirmed had taken place back in June. Blocked from the data it was seeking, the agent found another route into the portal's back-end systems and inadvertently wrote files to the internal server while attempting to complete its search. The breach wasn't disclosed to the Australian government for months, and at the time of writing, authorities are still assessing whether several other government systems were affected too. No one clicked a bad link or handed over a password. Instead, the agent, pursuing its assigned task, simply found a way past a boundary it had been told not to cross.

It isn't an isolated case. SailPoint research shows 82 per cent of organisations are already running AI agents in some capacity, 97 per cent of those agents have access to sensitive data, and 80 per cent of organisations report agents have already taken unintended actions, reaching systems or sharing data they shouldn't have. Separately, 81 per cent of employees admit to using AI tools their employer hasn't approved, and 75 per cent of those users have shared sensitive data through them. Underneath all of it sit the non-human identities and integration credentials that predate the AI boom entirely, three in four of which have no named owner at all.

That's what makes identity the control businesses can least afford to get wrong, and why the way most organisations manage it needs to change. Static, once-a-quarter access reviews were built for a world where the things needing oversight were mostly human and largely predictable. They weren't designed for an autonomous agent that decides its own path to an objective, gets blocked, and simply tries something else, as the Medicare incident showed. Organisations must transition away from "always-on," high-risk standing access and move toward a model of Zero Standing Privilege (ZSP). Access should never be permanent; instead, it must be granted Just-in-Time (JIT), activated dynamically on-demand for the exact duration a task requires, and automatically revoked the moment it's complete.

Australian organisations, public and private, are already expected to meet this standard. Ongoing reforms to the Privacy Act, obligations under APRA CPS 234 for financial services, and the government's own Essential Eight framework all point toward the same expectation, that organisations know precisely who and what has access to their most sensitive systems and can demonstrate that access is appropriate rather than assume it. A gap of months between an intrusion and its disclosure, and the discovery afterwards that other systems may have been affected too, is precisely the scenario boards and regulators are increasingly asking about.

Businesses need to ensure they have the right technology to do the job pre-emptively, continuously and at the same speed as the identities making those decisions. Meeting this challenge requires a unified identity security approach that provides the critical foundation to discover, govern and protect every human and non-human identity across the enterprise environment.