IBM acquires AuthMind to monitor usage of AI agent credentials – Unite.AI

IBM announced on November 12, 2026 that it had acquired AuthMind, an identity security company focused on observing identity activity and detecting threats. IBM plans to integrate AuthMind more deeply into HashiCorp Vault so that organizations can protect credentials and secrets as they are issued and as AI agents use them across applications, tools and data.

The agreement resolves a blind spot that appears after authentication. An agent can start with a valid identity and approved credentials, then change their behavior as they use different tools, outsource work to other agents, or reach out to more resources. Security teams must then determine whether their actions remain consistent with the authority they have been granted.

Security after granting access

HashiCorp Vault provides identity-based access controls, secrets management, and short-lived credentials. As part of Vault, IBM Agent Identity can apply that model to establish and govern the identities and authority of AI agents. AuthMind is intended to add the next level: visibility into how credentials are used after they leave Vault.

Suja Viswesan, IBM vice president for security products, said in the announcement that the AuthMind team will join IBM. The planned deeper integration is intended to help security teams move beyond a one-off access decision and supervise agents throughout their operation.

How the AuthMind activity graph works

AuthMind’s system is designed for continuous observation of the identities of people, machines and agents. Its identity activity graph maps the relationships between identities and resources, including the paths through which access occurs, so teams can examine activity across environments instead of relying only on individual permissions or isolated security events.

IBM said network traffic analysis can help reveal shadow agents and identities operating outside of established governance processes. The technology is also designed to track how identities interact with applications, systems and data, identify risks such as anomalous access, excessive permissions and possible policy violations, and provide context about the identities, assets and actions involved in an investigation.

This runtime information is intended to supplement Vault controls by showing how authorized access is used. IBM describes the result as a more seamless view of identity activity and emerging risks in hybrid environments, connecting the permissions an agent receives with what it does next.

IBM’s five-part agent security model

IBM places the acquisition in five areas of agent security: register each agent with a trusted identity and responsible owner, govern the authority delegated to it, and enforce least privilege access with identity-based policies and short-lived credentials. The framework also covers controlling resource access and permission usage, thus allowing security teams to restrict or revoke access in real time when unsafe or unauthorized activity occurs.

These steps treat agent security as an ongoing process because agents can run continuously, interact with multiple systems, and delegate work without a person approving every action. AuthMind activity data is intended to support audit and response phases, while Vault provides the identity and credential mechanisms for access control.

The acquisition builds on an existing relationship between the companies. AuthMind has worked with IBM through IBM Identity Protection on governance, risk detection and real-time remediation for AI agents and other non-human identities operating alongside IBM Vault. IBM Ventures invested in AuthMind’s seed round in 2023.

For companies that deploy agents across multiple systems, a valid credential alone cannot show whether subsequent behavior remains within policy. The planned integration is intended to connect Vault’s access controls with AuthMind’s view of observed activity, giving security teams the context to monitor agent behavior and intervene when access becomes risky.