Why Banks, Telcos, and Healthcare Are Turning to Identity Observability for Agentic AI
Banks, telecommunications carriers, and healthcare systems are moving on identity observability for agentic AI ahead of the rest of the market. That is what I see in the field, and the usual explanation is that regulated industries are more mature.
They are not more mature. Several have the oldest and messiest identity estates I have ever been handed.
The real reason is narrower and more interesting. In these three sectors, the compensating control we all quietly relied on was never plausible in the first place. Everywhere else, the accepted risk on unenumerated service accounts and over-scoped automation credentials was signed off against an unwritten assumption that a human would probably notice in time. In a regional bank that assumption was at least arguable. In an estate with hundreds of thousands of machine identities spanning forty years of acquired infrastructure, three decades of batch automation, and a third-party chain nobody has fully mapped, it was never arguable at all.
These organizations have also been asked, repeatedly, by regulators and auditors, to produce evidence that the assumption held. Being asked to show your work has a clarifying effect.
So they are moving first not because agents created a new problem for them, but because agents removed the last of the slack from a problem they were already documented as having.
Four structural conditions they share
Strip away the sector language and the same four conditions show up in all three.
An inherited machine identity estate nobody designed. Decades of mergers, core systems that predate the people running them, batch jobs whose original author left in 2009, integration accounts created for a migration that finished years ago and never revoked. This is the population agents now join, and it was already the largest undocumented attack surface in the organization. Across our customer base roughly 65% of the AI and automation identities we surface are unmanaged, and about half were absent from the customer's own inventory before we looked. In these three sectors, the absolute numbers behind those percentages are brutal.
Third-party chains with delegated authority. Core banking providers, clearing networks, roaming partners, claims clearinghouses, EHR vendors, managed service providers. Every one of those relationships involves credentials crossing an organizational boundary, and agents now act under authority that was delegated through two or three of those hops. Reconstructing the chain after an incident is hard. Evaluating it at decision time is what ARISE layer two actually demands.
Consequences that are irreversible at machine speed. A payment executes. A number ports. A prescription or an order posts to a clinical record. These are not actions you undo with a rollback script, which means detection after the fact has a materially lower value here than in an industry where the worst case is a data copy.
A regulator who wants evidence, not intent. This is the condition that changes behavior most, and it is the reason these sectors buy differently. Policy documents do not satisfy an examiner. Reconstructing which identity did what, under whose authority, with what credential, on a specific date, does. That is an observability output before it is a security one.
Notice that none of those four are about AI. They describe the same estate these organizations had in 2020. What changed is that the fourth condition now gets asked about the first three in the context of agents, and the answers are not ready.
Banking: the rules already apply
The most common misconception I hear from banking security teams is that agent governance is waiting on new regulation. It is not. The existing obligations already reach agents, and the supervisors have said so.
NYDFS made this explicit. In an October 2024 industry letter, the department clarified that existing Part 500 obligations apply directly to AI deployments, without new requirements being added. Read the sections with agents in mind and the implications are concrete.
Section | Obligation | What it means for an agent |
500.6 | Audit trails | Operation-level logging of what NPI was accessed, by which agent, under what authorization, retained five years |
500.7 | Access controls | Limits on NPI access extend to agent workflows at the operation level |
500.9 | Risk assessment | Must address AI-related risk from your own AI use and from vendors |
500.11 | Third-party management | Substantive due diligence on AI vendors whose infrastructure processes NPI |
500.16 | Incident response | Plans must cover AI-related events, 72-hour notification for qualifying incidents |
Section 500.6 is the one that should drive architecture decisions. Operation-level logging, by agent, with the authorization it acted under, retained for five years. You cannot produce that from authentication events alone, and you cannot produce it at all if the agent is one nobody registered. Deploying an agent also constitutes a material change to information systems, which triggers a risk assessment update.
In Europe, DORA has been applicable to financial entities since January 2025, and its structure pushes the same direction from a resilience angle rather than a cyber one: ICT risk management, mapping of ICT third-party dependencies, and a register of information covering contractual arrangements. An agent acting under authority delegated through a third-party provider sits squarely inside that mapping requirement. Firms that built their register from contracts rather than from observed system behavior are going to find the two documents disagree.
None of this requires a new rule to be written, which is the point. The obligations were drafted around principles that have not changed: know who has access, log what they did, assess your risk, watch your vendors. Same fundamentals. The examiner is simply now asking them about a population most banks cannot fully enumerate.
Telecom: scale that breaks manual governance
Carriers have the largest machine identity populations I encounter, and it is not close. Network element management, OSS and BSS integration, provisioning and activation, mediation and billing, roaming interconnect, lawful intercept infrastructure, and the automation layered on top of all of it across multiple generations of network technology that still run concurrently.
At that scale, every governance approach that depends on someone reviewing something fails arithmetically. Quarterly access certification over hundreds of thousands of machine identities is not a control. It is a ritual, and everyone performing it knows.
This is also why the carrier sector is the clearest illustration of the thesis running through this series. Nobody in telecom security has been unaware that their service account estate was over-scoped and under-documented. It has been on risk registers for years, accepted, with the same unwritten compensating control: exploitation is slow, and we will see it.
That assumption has been tested in public more than once. Intrusions against telecommunications providers have drawn joint advisories from CISA, the FBI, and international partners over the past two years, and I am deliberately not going to characterize the tradecraft in any of them. We do not have first-hand indicators, and in this sector the difference between what was reported and what actually happened inside a carrier is usually wide. I would rather understate it than be confidently wrong in print.
What the aggregate data does support is the shape of the problem, and the shape is enough. CrowdStrike reports that 82% of detections were malware-free, with intrusions running on valid credentials, trusted identity flows, and approved SaaS integrations. There is nothing foreign to find. Somebody logged in.
Agents make that the default operating condition rather than a sophisticated adversary's technique. An agent is supposed to hold credentials and chain tool calls without a human in the loop, because that is the product requirement. Every artifact that used to mark an intrusion, an agent generates as normal business.
The specific exposures worth naming for carriers are the ones where machine identity meets subscriber data or signaling: provisioning systems that can port a number, mediation platforms that touch call detail records, and CPNI stores that carry their own FCC obligations. Those are also precisely the action classes where an inline gate earns its latency budget, because the consequence is irreversible and the regulatory consequence is separate from the operational one.
For these estates, discovery built from observed activity rather than from configuration is not a preference. It is the only method that terminates. You will never finish surveying this population by asking teams what they deployed.
Healthcare: moving without waiting for the rule
Be precise about the regulatory position here, because a lot of vendor material is not.
The HIPAA Security Rule overhaul proposed in January 2025 is still not final law as of this month. HHS has pushed finalization repeatedly, with a current target around July 2027, and the proposal's own timeline of 60 days to effective date plus 180 days for compliance puts realistic compliance closer to March 2028. Anyone telling a hospital that mandatory MFA and asset inventories are a 2026 deadline is selling something.
What the proposal would make mandatory is worth reading anyway, because the list is a fair description of what good looks like: encryption of ePHI at rest and in transit, MFA across ePHI-touching systems, network segmentation, annual technology asset inventories, vulnerability scanning every six months, annual penetration testing, patch remediation within 15 days for critical issues, and documented recurring risk assessments.
Look at that list honestly. Not one item on it is a new idea. Asset inventory, MFA, segmentation, patching, encryption. This is the 2005 checklist with dates attached. The proposed rule is not an innovation, it is a regulator writing down the fundamentals because voluntary adoption did not happen.
Which is why the interesting healthcare organizations are not waiting for finalization. The ones I work with are moving now for reasons that have nothing to do with the rule's status.
Clinical AI agents are already in production: documentation, coding, prior authorization, triage support, imaging workflow. Each one acts on ePHI under some delegated authority, and in many deployments that delegation traces back to a clinician's identity, which means an agent action is attributable to a named provider. That has consequences beyond security. If a clinical agent posts an order under a physician's delegated authority, the reconstruction question is a medico-legal one, and the answer needs to survive a deposition rather than a SOC review.
The third-party dimension is heavier here than anywhere else. EHR platforms, claims clearinghouses, transcription and coding vendors, imaging services, revenue cycle management. Agents increasingly act across those boundaries, and the existing requirements around documented risk analysis and role-based access controls apply to those flows today, finalization or not.
The practical driver, though, is simpler than any of that. Healthcare systems have among the messiest identity estates in any sector, produced by decades of acquisitions and clinical systems that cannot be touched during business hours. They are moving on observability first because they genuinely do not know what is running, and the arrival of clinical agents made that unknowable population into a patient safety question rather than an audit finding.
What I would do Next
The regulated-industry version of this list is evidence-first, because in these sectors an unprovable control is functionally not a control.
Pick your most consequential agent and produce the evidence package a regulator would ask for. What did it do last Tuesday between 14:00 and 15:00, under whose delegated authority, with which credential, against what data. Time the exercise. If it takes three consoles and an analyst who knows the joins, you have a reconstruction capability that works at investigation speed and not at examination speed, and certainly not at enforcement speed.
Map your delegation chains across third-party boundaries and compare the result to your contractual register. Banks have this obligation explicitly under DORA's ICT third-party mapping. Everyone else has it implicitly the first time an agent does something under authority that crossed an organizational boundary. Where the observed chains and the paper register disagree, the observed chains are correct.
Tier your action classes by reversibility rather than by sensitivity. This is the framing that works with business owners in regulated environments, and it is better than the usual risk-rating conversation. A payment executing, a number porting, an order posting to a clinical record: irreversible, gate them inline. A read against non-regulated data: let it run. Reversibility is a question a business owner can answer without security vocabulary.
Test revocation propagation this week, because it is cheap and it is where the gap between claimed and actual control is widest. Revoke a non-production agent credential and measure how long until the action fails, not until the log entry appears. If you are waiting out a token lifetime, shorter lifetimes and CAEP-style signaling fix that this quarter without a new purchase.
Then deal with the deferred maintenance list, and frame it correctly when you take it upstairs. Static secrets in process environments, service accounts whose entitlements nobody can justify, shared credentials with administrative reach, signing keys stored beside ordinary secrets. None of that is an AI finding. All of it is a fundamental with an expired compensating control, and in a regulated industry it was always documented somewhere as accepted risk. Accepted risk becomes a finding the moment the acceptance rationale stops being true.
One caution specific to these sectors. Do not let an agent governance program become a separate workstream with its own tooling. You will end up with human IAM in one console, machine identity in another, and agents in a third, which reproduces the correlation gap that caused this. The chain crosses all three identity types, usually in a single transaction.
A leading indicator, not a special case
It is tempting for everyone else to read this as a compliance story that does not apply to them. That would be the wrong lesson.
These three sectors are not solving a different problem. They are solving the same problem earlier, because their version of it was never survivable and because someone external has been asking them to prove otherwise. The estate conditions that make banking, telecom, and healthcare move first, inherited machine identities nobody designed, delegated authority crossing organizational boundaries, irreversible actions, are arriving everywhere. Manufacturing, logistics, energy, retail, professional services. Agents are being deployed into all of them at the same rate, against the same inherited populations.
The only real difference is that regulated industries got asked to show their work first.
And this is where the whole series lands. Nothing in the agentic threat model is new. Least privilege, credential hygiene, inventory, segmentation, continuous verification. Correct in 2010, correct today, still mostly unfunded. What agents changed is not the control set. They repriced a set of risk acceptances that were flawed when we signed them, because every one of those acceptances rested on the same unwritten compensating control: exploitation is slow, a human will notice.
That control is gone. At 22 seconds from initial access to hand-off and one second to cluster admin, it is not degraded. It is gone.
The one genuine gap underneath all of it was never a missing product category. We never built the observability to correlate identity correctly, human and non-human, across the domains identities actually operate in. That absence is what made the bad bets look reasonable, because you cannot price a risk you cannot see, so we priced it at zero.
AuthMind exists to close that specific gap, across human, non-human, and agentic identities in one model, and SACR and Gartner both described a version of it within three weeks of each other. But the framing matters more than the vendor. If you work in one of these three sectors, you already have the list. If you do not, you have the same list and nobody has asked you for it yet.
Somebody will. Probably an agent, and probably faster than the meeting you were planning to discuss it in.
Sources
NYDFS Part 500 and AI: what New York's cybersecurity regulation requires of agent governance
M-Trends 2026, Mandiant / Google Cloud
ARISE: Agentic Runtime Identity Security Enforcement, Software Analyst Cyber Research, September 2026
Gartner Innovation Insight: Identity Visibility and Intelligence Platforms, 24 August 2026
Gartner does not endorse any vendor, product or service depicted in its research publications. Representative Provider and representative vendor designations do not constitute endorsement.
Comments