The biggest identity risk in Federal environments probably isn’t human
Ask a Federal CISO what their biggest identity risk is right now, and most will say AI. Non-human identities (NHIs), service accounts, bots, and now AI agents out number Federal personnel by more than 20 to 1, per Federal News Network’s recent reporting on Federal insider risk.
The Government Accountability Office (GAO) continues to flag these identities as poorly governed and rarely audited across the federal enterprise. Most agencies don’t have a clean answer for how many of these accounts exist in their own environment, let alone what each one can actually touch.
Agencies don’t have a visibility problem or a compliance problem, they have both
Visibility and compliance live in the same systems, and most privileged access management (PAM) tools were built to solve only one. Delinea’s Secret Server just earned FedRAMP High authorization, delivered by UberEther, because that’s the foundation agencies need to close this gap in practice. It’s the layer everything else depends on to make compliance and security move at the same speed instead of fighting each other.
How AI agents change the math
AI agents raise the stakes on that foundation in a specific, and much bigger way. A service account does what it was programmed to do. An AI agent decides what to do in the moment, requests access it wasn’t explicitly granted and escalates its own privilege based on context nobody scripted in advance. In 80% of cases, security teams can’t fully explain why an agent took a privileged action, per Delinea’s 2026 Identity Security report.
Vaulting passwords was never going to solve that. The real requirement is continuously validating who has access, when, and for what reason, with the ability to revoke or deny that access at machine speed. Just-in-time provisioning, session monitoring and policy-based enforcement aren’t optional add-ons to that model. They are the model.
FedRAMP is going through its own version of the same shift. The program ran for over a decade on annual, point-in-time assessments. A single day snapshot stood in for a year of security posture. General Services Administration (GSA) is rolling out a modernized authorization path called FedRAMP 20x. It replaces those assessments with continuous, machine-readable validation of systems as they run. A once-a-year checkmark isn’t a real measure of ongoing risk, for the same reason a once-a-year identity review won’t catch an agent that changed behavior in week three.
How Delinea and UberEther deliver FedRAMP High-authorized PAM
This is why the Delinea and UberEther partnership matters beyond the authorization itself. A jointly architected, pre-configured platform that meets FedRAMP High requirements from the outset allows agencies to shorten authorization times, skip costly integration cycles and focus their attention on mission outcomes instead of audit fatigue. It’s available through the federal contract vehicles agencies already use. Agencies can deploy it as a turnkey solution your own cybersecurity staff runs, or as a managed component that UberEther operates on your behalf. Either way, it hands federal leaders clarity and cost-efficiency that most don’t currently have.
The National Institute of Standards and Technology (NIST) is racing to build the standard for the harder half of this problem. Its Center for AI Standards and Innovation launched an AI Agent Standards Initiative in February. The National Cybersecurity Center of Excellence (NCCoE) followed with a concept paper stating plainly that identity frameworks built for humans logging into systems don’t hold up when the identity is an agent that executes tasks autonomously, across systems, faster than any per-action approval process can keep pace. The Office of Management and Budget (OMB) has already told agencies to appoint Chief AI Officers and inventory their AI systems. None of that tells an agency how to enforce access for an agent mid-session. When the body writing the rule admits the rule doesn’t exist yet, every agency operating today is already behind it.
The cost of stacking tools instead of consolidating
Agencies are also working through this with tools stacked on top of each other instead of one system built to handle it all. With separate credential systems, contracts, and audit trails that don’t talk to each other, every FedRAMP review becomes a fire drill instead of a formality. A unified platform consolidates all of this and changes whether an agency can answer “who accessed what and why” in an afternoon rather than assembling a task force after something’s already gone wrong.
FedRAMP’s 20x model swaps annual audits for continuous, automated validation. Delinea's Secret Server already meets that bar, with defensible access enforcement across human, machine, and AI agent identities, ready for procurement today.
Learn more at Delinea.com/solutions/fedramp
