Meet AI Lucy: Your Company's Newest Privileged User

Michelle Drolet is CEO of Towerwall, a specialized cybersecurity firm focused on proactive cyber preparedness and compliance services.

Lucy in finance has a new assistant. Let’s call her “AI Lucy”: a digital version of herself that works with her logins, permissions and access to company data.

AI Lucy has made Lucy’s job ​a lot easier, sorting the inbox, updating the CRM, pulling figures from databases and drafting replies to suppliers, all without Lucy having to sweat the details.

This new way of working isn’t unique to our fictional Lucy, and what she and many real business leaders overlook is the risk. AI Lucy can log in to company systems and act on Lucy’s behalf with very little human oversight.

Most discussions on the risk of AI think narrowly in terms of data leaking from employees pasting sensitive information into a chatbot. AI agent risk derives in part from these autonomous agents acting as privileged digital identities, each with their own network of automated permissions.

Following The Money

Just like employees, AI agents have identities of their own. These are in the form of logins and the authority to act on a user’s behalf. Security vendors have taken note, acquiring AI companies designed to protect identities and govern AI workplace use. One of the world’s largest security vendors paid roughly $25 billion for a leading identity security platform, citing identities, software and AI alike as the main vector by which attackers enter systems.

And it doesn’t end there. A major endpoint security company acquired a startup that monitors how employees use AI tools, while a major player in cybersecurity and compliance acquired a company that monitors how AI tools and agents are used at work and blocks risky activity in real time.

Think of these deals as leading indicators of the kind of threats security teams are most worried about. The message being conveyed is that it is “identity” that rigorously defines what needs protection.