When an AI Agent Is the Incident, the Identity Record Is the Evidence

Author: Len Noe, Solutions Architect, BeyondTrust

The first question on any incident bridge isn’t about why it happened--it’s whose credentials were used. In my experience, whoever can answer that credential question in the first hour sets the pace for everything after it: what to isolate, what to revoke, whom to notify, and how far the damage could have spread.

The teams that can’t answer it spend the first day reconstructing their answer from logs that were never designed to provide it.

That discipline is about to be tested by a new kind of actor. On October 16, 2026, the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) jointly published ten voluntary practices for incident readiness and response when AI agents act in ways nobody directed.