IBM has acquired AuthMind, an identity security company that tracks how human, machine and AI agent identities use their access, and plans to build its technology more deeply into HashiCorp Vault. IBM disclosed the deal in a newsroom post by Suja Viswesan, its vice president of security products, which did not give a price.
Vault already handles identity-based access controls, secrets management and short-lived credentials, and IBM Agent Identity, part of Vault, extends that approach to establishing and governing the identities and authority of AI agents. IBM said AuthMind adds visibility “beyond the point of access,” helping organizations understand how credentials are used once they leave Vault.
At the center of AuthMind’s technology is an identity activity graph that maps the relationships and access paths between identities and the resources they interact with. IBM said it can discover shadow agents and identities operating outside established governance processes by analyzing network traffic, and flag risks such as unusual access patterns, excessive permissions and potential policy violations.
“An agent may have a legitimate identity and authorized credentials, but its behavior can change as it interacts with new tools, delegates tasks or accesses additional resources,” Viswesan wrote. Security teams, she said, need to see those interactions to tell expected activity from potential risk. Organizations need to know which agents are operating, who or what authorized them, what they can access, what actions they are taking and when to intervene, according to the post.
IBM described five areas it is building into its security and automation platform for agents: registering each agent with a trusted identity and clear ownership, governing the authority agents receive to act for users or other agents, enforcing least-privilege access with short-lived credentials, auditing agent actions, and restricting or revoking access in real time when unsafe activity is detected.
The two companies were already linked. IBM Ventures invested in AuthMind’s seed round in 2023, and AuthMind had worked with IBM through IBM Identity Protection to extend governance, risk detection and real-time remediation to AI agents and other non-human identities operating alongside Vault. AuthMind raised $19.3 million in April 2025 to expand its platform.
“We’re excited to welcome the AuthMind team to IBM and continue helping organizations securely scale AI agents across their environments,” Viswesan wrote.
Sources: IBM Newsroom
–
By the ID Tech Editorial Team
