SaaS、非人类身份和用户真实性：风险的新时代

探索 SaaS 生态系统中非人类身份 (NHI) 不断上升的风险，以及动态安全平台如何帮助维护用户的真实性。

SaaS ecosystems are evolving, and not all users are human. AI assistants, automation bots, and API tokens are now common, introducing new risks related to non-human identities (NHIs) and user authenticity. Let's dive into it!

SaaS 生态系统正在不断发展，但并非所有用户都是人类。人工智能助手、自动化机器人和 API 代币现在很常见，带来了与非人类身份 (NHIs) 和用户真实性相关的新风险。让我们深入了解一下吧！

The Rise of Non-Human Identities in SaaS

SaaS 中非人类身份的兴起

As SaaS platforms expand, non-human identities (NHIs) like AI assistants and automation bots are increasingly prevalent. These entities often have significant access privileges, sometimes exceeding those of human users. This rise introduces a new class of risk: unmonitored, long-lived, and often misunderstood access.

随着 SaaS 平台的扩展，人工智能助手和自动化机器人等非人类身份 (NHI) 越来越普遍。这些实体通常具有重要的访问权限，有时甚至超过人类用户的访问权限。这种增长带来了一种新的风险：不受监控、长期存在且经常被误解的访问。

Data Breaches Involving NHIs

涉及 NHI 的数据泄露

The risks of unmanaged NHIs aren't theoretical. Attackers have already targeted these identities in high-profile breaches. For example:

不受管理的国民健康保险的风险并不是理论上的。攻击者已经在备受瞩目的违规事件中瞄准了这些身份。例如：

• Salesloft/Drift OAuth Token Breach (2025): Hackers stole OAuth tokens, accessing Salesforce CRM data at hundreds of organizations.
• New York Times GitHub Token Leak (2024): An exposed GitHub API token granted access to 270 GB of internal source code and data.
• Cloudflare Atlassian Compromise (2023): Attackers used an overlooked API token to access Cloudflare's Atlassian suite, bypassing password resets.

How Dynamic SaaS Security Platforms Can Help

动态 SaaS 安全平台如何提供帮助

Addressing NHI challenges requires rethinking traditional security. Dynamic SaaS Security Platforms offer a solution by adapting to the complex web of SaaS apps and identities.

应对 NHI 挑战需要重新思考传统安全。动态 SaaS 安全平台通过适应复杂的 SaaS 应用程序和身份网络来提供解决方案。

Unified Visibility of All Identities

所有身份的统一可见性

Security teams need real-time visibility into all NHIs in their SaaS stack, including third-party app connections and API tokens. Mapping these identities and their access permissions helps illuminate hidden risks.

安全团队需要实时了解 SaaS 堆栈中的所有 NHI，包括第三方应用程序连接和 API 令牌。映射这些身份及其访问权限有助于揭示隐藏的风险。

Least Privilege Enforcement

最小特权执行

Dynamic SaaS security tools analyze NHI permissions and usage to flag overly permissive access. Enforcing least privilege ensures integrations only access necessary data, reducing the impact of potential breaches.

动态 SaaS 安全工具分析 NHI 权限和使用情况，以标记过度宽松的访问。强制执行最小权限可确保集成仅访问必要的数据，从而减少潜在违规的影响。

Continuous Anomaly Monitoring

持续异常监控

Platforms monitor identity behaviors, establishing baselines and flagging deviations. Anomalous activities, such as unusual data access, are instantly detected.

平台监控身份行为，建立基线并标记偏差。立即检测到异常活动，例如异常数据访问。

Remediation and Rotation

补救和轮换

Dynamic platforms automate response actions upon detecting high-risk events. They can revoke tokens, disable app integrations, or quarantine accounts, and also automate credential rotation.

动态平台在检测到高风险事件时自动执行响应操作。他们可以撤销令牌、禁用应用程序集成或隔离帐户，还可以自动进行凭证轮换。

The Future of Enterprise SaaS with AI Agents

企业 SaaS 与 AI 代理的未来

Looking ahead, AI agents are set to reshape enterprise SaaS. Aaron Levie, co-founder and CEO of Box, envisions a hybrid future where SaaS provides the backbone and AI agents act as intelligent co-pilots.

展望未来，人工智能代理将重塑企业 SaaS。 Box 联合创始人兼首席执行官 Aaron Levie 设想了一个混合的未来，其中 SaaS 提供骨干，AI 代理充当智能副驾驶。

Levie emphasizes the importance of deterministic systems for mission-critical operations. He suggests a separation where core workflows remain in structured SaaS environments, while AI agents provide intelligent assistance.

Levie 强调了确定性系统对于关键任务操作的重要性。他建议进行分离，核心工作流程保留在结构化的 SaaS 环境中，而人工智能代理则提供智能帮助。

Business Model Transformation

商业模式转型

The rise of AI agents necessitates a shift from per-seat licensing to consumption-based pricing. Companies will pay for actual usage, data processed, or tasks completed by AI agents, reflecting the increased number of automated entities.

人工智能代理的兴起需要从按席位许可转向基于消费的定价。公司将为人工智能代理的实际使用、处理的数据或完成的任务付费，这反映了自动化实体数量的增加。

Seizing the Platform Shift

抓住平台转变

This transformation presents a unique opportunity for startups to build solutions from the ground up with an agent-first mindset. By creating infrastructure and applications that redefine how work gets done, startups can capitalize on this platform shift.

这种转变为初创公司提供了一个独特的机会，可以以代理优先的心态从头开始构建解决方案。通过创建重新定义工作完成方式的基础设施和应用程序，初创公司可以利用这一平台转变。

Conclusion: Secure Your SaaS, Humans, and Beyond

结论：保护您的 SaaS、人员及其他安全

The future of SaaS involves a blend of human and non-human identities. Securing these ecosystems requires dynamic security platforms that offer visibility, enforce least privilege, and continuously monitor for anomalies.

SaaS 的未来涉及人类和非人类身份的融合。保护这些生态系统需要动态安全平台来提供可见性、强制执行最低权限并持续监控异常情况。

So, next time you're sipping your morning coffee, remember: it's not just about securing your human users anymore. Keep those bots in check, and your SaaS environment will thank you for it!

因此，下次您早上喝咖啡时，请记住：这不再只是保护人类用户的安全。控制住这些机器人，您的 SaaS 环境将会感谢您！