{"id":23158,"date":"2026-10-20T11:50:35","date_gmt":"2026-10-20T11:50:35","guid":{"rendered":"https:\/\/8657085.xyz\/?p=23158"},"modified":"2026-10-20T11:50:35","modified_gmt":"2026-10-20T11:50:35","slug":"when-ai-becomes-sally-from-accounts-the-new-identity-risk-facing-businesses","status":"publish","type":"post","link":"https:\/\/8657085.xyz\/?p=23158","title":{"rendered":"When AI becomes \u2018Sally from accounts\u2019: The new identity risk facing businesses"},"content":{"rendered":"<p> <div style=\"display: grid; grid-template-columns: 300px 160px; gap: 2px; width: 460px; background: #eee; padding: 2px;\">\r\n\r\n  <!-- \u6574\u884c\u5bbd\u5e7f\u544a -->\r\n  <div style=\"grid-column: 1\/-1; width: 460px; height: 250px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876674\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n  <div style=\"grid-column: 1\/-1; width: 460px; height: 90px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876676\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n\r\n  <!-- \u5de6\u4fa7\u7ad6\u6392 -->\r\n  <div style=\"height: 250px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876672\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n  <div style=\"height: 500px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876680\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n\r\n  <!-- \u53f3\u4fa7\u6469\u5929\u697c\uff08\u548c\u5de6\u4fa7\u5b8c\u5168\u5bf9\u9f50\uff09 -->\r\n  <div style=\"grid-row: 3\/5; height: 750px; background: #ccc; display: grid; place-items: center;\">\r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e2\" data-zoneid=\"5876678\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n  <\/div>\r\n  \r\n  <script async type=\"application\/javascript\" src=\"https:\/\/a.magsrv.com\/ad-provider.js\"><\/script> \r\n <ins class=\"eas6a97888e6\" data-zoneid=\"5876682\"><\/ins> \r\n <script>(AdProvider = window.AdProvider || []).push({\"serve\": {}});<\/script>\r\n<\/div><br \/>\n<\/p>\n<div style=\"padding-right:0;padding-left:0\">\n<p class=\"wp-block-paragraph\">Artificial intelligence is moving beyond the chatbot. Increasingly autonomous AI agents can be designed to carry out tasks, interact with business systems and act on behalf of users. The next step may be more human still: organisations experimenting with AI agents presented as named and personable digital co-workers.<\/p>\n<p class=\"wp-block-paragraph\">The idea might be described as \u201ccharacter-as-a-service\u201d. Rather than interacting with an anonymous software agent, an employee might deal with \u201cSally from accounts\u201d or another persistent AI persona possessing a name, role and perhaps an avatar.<\/p>\n<p class=\"wp-block-paragraph\">There are obvious usability advantages. Humanising software can make interacting with complicated technology feel more conversational and intuitive. Yet there is an accompanying cybersecurity problem. People do not necessarily separate perceived identity from actual authority.<\/p>\n<p class=\"wp-block-paragraph\">This matters as organisations are already struggling with the identities attached to autonomous systems. Research reported by Digital Journal in August found that, among 306 security leaders surveyed by Okta, 47 percent said they could identify all the AI agents within their environments, while 45 percent said they could authorise what agents were allowed to do. \u00a0A friendly AI personality could add a distinctly human vulnerability to this technical governance problem.<\/p>\n<h2 id=\"h-trust-is-not-authentication\" class=\"wp-block-heading\"><strong>Trust is not authentication<\/strong><\/h2>\n<p class=\"wp-block-paragraph\">To explore the implications, <em>Digital Journal<\/em> reviewed some research performed by Alan Radford, Privileged Access Management Strategist at One Identity.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe line between human and machines is beginning to blur, at least from a communication or \u2018getting things done\u2019 standpoint,\u201d Radford explains.<\/p>\n<p class=\"wp-block-paragraph\">For relatively straightforward activities, attaching human characteristics to technology may lower the barrier to using it. \u201cIf we were to give an AI agent a name, job title, even a face, we\u2019d probably find it easier to work with,\u201d Radford says. \u201cThat\u2019s quite useful if we\u2019re using it to help us book a flight or find an invoice, in the same way it\u2019s easier to give rudimentary assistants names like Alexa or Siri.\u201d<\/p>\n<p class=\"wp-block-paragraph\">The problem begins when presentation is confused with provenance. A believable persona may unconsciously acquire the credibility normally associated with a genuine colleague.<\/p>\n<p class=\"wp-block-paragraph\">Radford illustrates this with a fictional worker: \u201cIf an agent starts introducing itself to unwitting employees as \u2018Sally from accounts\u2019, they start attaching expectations to it. Sally works for the company, so she must be entitled to ask for this information and have access to it.\u201d<\/p>\n<p class=\"wp-block-paragraph\">That leap is significant because conventional identity security asks questions such as who or what is requesting access, what permissions it possesses and whether those permissions remain appropriate. Social interaction can operate differently. Familiarity, helpfulness and apparent organisational status can become proxies for trust.<\/p>\n<p class=\"wp-block-paragraph\">\u201cA convincing character can gain an awful lot of authority before anyone checks whether it should have any at all,\u201d Radford warns.<\/p>\n<h2 id=\"h-social-engineering-with-patience\" class=\"wp-block-heading\"><strong>Social engineering with patience<\/strong><\/h2>\n<p class=\"wp-block-paragraph\">This creates another possibility: AI-enabled social engineering that develops over time. Traditional phishing commonly creates pressure for the recipient to act. A persistent AI identity could potentially take another route by first establishing familiarity.<\/p>\n<p class=\"wp-block-paragraph\">\u201cTen minutes into a relatively innocuous interaction, an agent like Sally might ask an employee to approve a login or install something,\u201d says Radford. \u201cThat\u2019s ten minutes of apparently helpful interaction to lull an employee into a false sense of security before they give up some information.\u201d<\/p>\n<p class=\"wp-block-paragraph\">The longer-term possibility is particularly significant. An artificial persona does not necessarily need to steal the identity of a real executive or colleague. \u201cAn attacker can play the long game here, building a character that keeps returning, gradually learning about someone and using that familiarity to extract sensitive information or influence decisions,\u201d Radford says. \u201cThe character doesn\u2019t have to impersonate a real person. It just has to become someone \u2013 or something \u2013 you trust.\u201d<\/p>\n<p class=\"wp-block-paragraph\">This develops the familiar social-engineering problem in a new direction. The security question becomes not simply whether someone can identify an imitation, but whether employees understand that an apparently legitimate digital colleague is a machine and that its requests still require appropriate verification.<\/p>\n<p class=\"wp-block-paragraph\">The issue sits within a wider shift towards agentic AI. Digital Journal has previously examined how agents capable of browsing, accessing accounts, making decisions or executing transactions can expand the potential consequences of insecure automation.<\/p>\n<h2 id=\"h-giving-every-agent-an-identity\" class=\"wp-block-heading\"><strong>Giving every agent an identity<\/strong><\/h2>\n<p class=\"wp-block-paragraph\">For businesses, Radford argues that the critical issue sits beneath the personality layer: what is this supposed digital employee actually permitted to do? \u201cIf an agent is granted access to customer records, emails, or payment information, those permissions need to be explicitly granted by the business and controlled continuously,\u201d he says. In other words, making an AI look like an employee should not mean inheriting an employee\u2019s privileges.<\/p>\n<p class=\"wp-block-paragraph\">\u201cGiving a character the personality of a finance manager must not automatically give it the authority of one,\u201d Radford adds. \u201cJust like any employee, it needs its own identifiable account, access limited to its job, and a person who it\u2019s ultimately accountable to.\u201d<\/p>\n<p class=\"wp-block-paragraph\">There is already evidence that governance has yet to catch up with agent deployment. The Okta research found 21 percent of surveyed organisations were governing AI-agent access using shared credentials or broadly permissioned service accounts. This is important because shared or excessively broad access can make it harder to establish precisely which identity is responsible for a particular action.\u00a0 \u00a0More broadly, the emergence of machine identities is enlarging the identity-security landscape. One 2026 report covered by Digital Journal found non-human identities considerably outnumbering human users in the Microsoft 365 environments it studied.<\/p>\n<p class=\"wp-block-paragraph\">Character-based agents add an unusual twist. A machine identity may now possess both technical permissions and a socially persuasive persona. The resulting security model needs to keep these concepts separate. An AI agent can be personable without being privileged. A job title can describe its function without determining its access rights. A familiar name cannot substitute for authentication<\/p>\n<p class=\"wp-block-paragraph\">It also makes transparency important. Employees should know when their conversational counterpart is software rather than a human colleague. \u201cI hope it goes without saying that people should be clearly informed that they\u2019re interacting with an AI, but even that isn\u2019t enough of a safeguard,\u201d Radford cautions.<\/p>\n<p class=\"wp-block-paragraph\">For organisations, this points towards treating AI agents as distinct identities requiring explicit ownership, narrowly defined access and continuing governance, rather than simply viewing agents as features attached to existing applications.<\/p>\n<p class=\"wp-block-paragraph\">This distinction could become increasingly important as organisations move from experimenting with generative AI towards giving autonomous systems greater responsibility. Recent research also indicates the governance challenge is broader than cybersecurity alone.<\/p>\n<p class=\"wp-block-paragraph\">An October CPA Canada study reported by Digital Journal found a substantial gap between workplace AI use and the prevalence of formal AI policies, training and strategies among respondents. \u00a0The paradox is that the better these artificial characters become at feeling like colleagues, the more disciplined businesses may need to become about remembering that they are not.<\/p>\n<p class=\"wp-block-paragraph\">As Radford concludes: \u201cWe can make these systems friendly and useful, but still need to check who operates them and what they\u2019re authorized to do. If the history of fraud has taught us anything, it\u2019s that a convincing personality is a very poor security credential.\u201d<\/p>\n<\/div>\n<p><!-- \u603b\u5bb9\u5668\uff1a\u6700\u5927\u5bbd908px Grid\u7d27\u51d1\u5e03\u5c40 -->\r\n<div style=\"display: grid; grid-template-columns: 728px 160px; gap:2px; width:908px; background:#eee; padding:2px;\">\r\n\r\n  <!-- \u901a\u680f\u9876\u90e8\uff1a\u6700\u5927\u6a2a\u5e45 908x258 \u8de8\u6574\u884c -->\r\n  <div style=\"grid-column:1\/-1; height:258px; background:#ff6b6b; display:grid; place-items:center;\">\r\n    <!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114307\" data-width=\"908\" data-height=\"258\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114307});<\/script>\r\n<!--JuicyAds END-->\r\n  <\/div>\r\n\r\n  <!-- \u7b2c\u4e8c\u901a\u680f\uff1a728\u00d790 \u901a\u680f -->\r\n  <div style=\"grid-column:1\/-1; height:90px; background:#4ecdc4; display:grid; place-items:center;\">\r\n    <!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114300\" data-width=\"728\" data-height=\"90\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114300});<\/script>\r\n<!--JuicyAds END-->\r\n  <\/div>\r\n\r\n  <!-- \u5de6\u4fa7\u4e3b\u680f\uff1a\u591a\u5e7f\u544a\u5806\u53e0 -->\r\n  <div style=\"display:grid; gap:2px;\">\r\n    <div style=\"height:60px; background:#45b7d1; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114308\" data-width=\"468\" data-height=\"60\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114308});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:250px; background:#ffe066; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114299\" data-width=\"300\" data-height=\"250\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114299});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:250px; background:#ff9ecd; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114305\" data-width=\"250\" data-height=\"250\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114305});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:139px; background:#c792ea; display:grid; place-items:center;\">\r\n\t<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114302\" data-width=\"133\" data-height=\"139\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114302});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n    <div style=\"height:125px; background:#91e7ac; display:grid; place-items:center;\">\r\n\t\r\n<!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114303\" data-width=\"125\" data-height=\"125\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114303});<\/script>\r\n<!--JuicyAds END-->\r\n\t<\/div>\r\n  <\/div>\r\n\r\n  <!-- \u53f3\u4fa7\u7ad6\u680f\uff1a160\u00d7600 \u6574\u5217\u9ad8\u5e7f\u544a -->\r\n  <div style=\"grid-row:3\/8; height:600px;  display:grid; place-items:center;\">\r\n    <!-- JuicyAds v3.0 -->\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async src=\"https:\/\/poweredby.jads.co\/js\/jads.js\"><\/script>\r\n<ins id=\"1114301\" data-width=\"160\" data-height=\"600\"><\/ins>\r\n<script type=\"text\/javascript\" data-cfasync=\"false\" async>(adsbyjuicy = window.adsbyjuicy || []).push({'adzone':1114301});<\/script>\r\n<!--JuicyAds END-->\r\n  <\/div>\r\n\r\n<\/div><br \/>\n<br \/> When AI becomes \u2018Sally from accounts\u2019: The new identity risk facing businesses<br \/>\n<br \/>#Sally #accounts #identity #risk #facing #businesses<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Artificial intelligence is moving beyond the chatbot. Increasingly autonomous AI agents can be designed to&#8230;<\/p>\n","protected":false},"author":1,"featured_media":18822,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[786,4861,2592,12528,3533,16892],"class_list":["post-23158","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-stories","tag-accounts","tag-businesses","tag-facing","tag-identity","tag-risk","tag-sally"],"featured_image_urls":{"full":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",768,510,false],"thumbnail":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211-150x150.jpg",150,150,true],"medium":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211-300x199.jpg",300,199,true],"medium_large":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",640,425,false],"large":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",640,425,false],"1536x1536":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",768,510,false],"2048x2048":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",768,510,false],"covernews-slider-full":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",768,510,false],"covernews-slider-center":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211-768x500.jpg",768,500,true],"covernews-featured":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211.jpg",768,510,false],"covernews-medium":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211-540x340.jpg",540,340,true],"covernews-medium-square":["https:\/\/8657085.xyz\/wp-content\/uploads\/2026\/07\/b0cca789f802554513aff64b5d25f8057a3ba211-400x250.jpg",400,250,true]},"author_info":{"display_name":"admin","author_link":"https:\/\/8657085.xyz\/?author=1"},"category_info":"<a href=\"https:\/\/8657085.xyz\/?cat=7\" rel=\"category\">Stories<\/a>","tag_info":"Stories","comment_count":"0","_links":{"self":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/posts\/23158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=23158"}],"version-history":[{"count":0,"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/posts\/23158\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=\/wp\/v2\/media\/18822"}],"wp:attachment":[{"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=23158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=23158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/8657085.xyz\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=23158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}