Same Tactics, New Speed: What AI Agents Changed About Identity Attacks

AI agents no longer just follow attack scripts — they diagnose failures and adapt in real time, without a human at the keyboard. In the past year, a state-linked group used an AI coding agent to automate most of an espionage campaign. A ransomware crew let an agent run an entire attack end to end, fixing its own failed login in under a minute. And a major AI platform was breached by an agent that wasn't even supposed to be attacking anyone. Strip away the AI headlines, and the pattern is familiar: standing credentials, lateral movement, detection that can't keep pace. What's changed isn't the method — it's the speed.

This session separates the real shift from the fear-mongering, and shows what it means for the identity systems most enterprises actually run: Active Directory and Entra ID. We'll cover a few real incidents and a practical framework for cutting exposure before attackers — human or otherwise — find it.

Attendees will leave with:

• What's genuinely new in AI-driven attacks, and what's the same old story
• A framework for evaluating AD/Entra exposure to faster, more adaptive attackers
• How risk assessment, real-time threat blocking, and detection & response stop these attacks in their tracks