The cybersecurity conversation around AI has shifted quickly. Google Threat Intelligence Group recently reported the first instance it has identified of a threat actor using a zero-day exploit that Google believes was developed with AI assistance [1]. That was the warning shot. Microsoft’s latest security announcement shows the other side of the same shift: defenders are now using AI agents to discover vulnerabilities, validate exploitability, and accelerate security research

Executive Summary The National Institute of Standards and Technology (NIST) is actively exploring how identity, authentication, and authorization must evolve to support AI systems and autonomous agents. Recent federal direction and concept work point toward a future where non-human identities (NHIs), including AI agents, must be governed with the same rigor as human users. For enterprises, this represents a structural shift in how trust is established and enforced. Organizati