Equifax on Why Identity Comes First for AI Agents | Saviynt

English

Transformation after transformation

Equifax has been through what Farshchi calls transformation after transformation. He describes decommissioning 45 data centers and nine mainframes, refactoring thousands of applications, and becoming a leader in security along the way. He notes that Equifax now runs roughly 1,500 AI agents in its Google Cloud environment.

That experience shapes how he sees what comes next. For Farshchi, identity is the single most critical factor in whether AI reaches its full potential.

Agents can't repeat the service account problem

Farshchi points to a pattern most security leaders will recognize. At every company he has joined, nobody could say what the service accounts were doing, and teams were afraid to turn them off because they couldn't predict the impact.

AI agents raise the stakes because they act on their own. Without guardrails from top to bottom, he warns, agents become the next version of that problem, only worse. Those guardrails need to provide visibility, accountability, and runtime controls.

Everyone becomes a builder

At an Equifax global leadership conference, Farshchi shared a vision of everyone in the company becoming a builder. Anyone in marketing, human resources, or finance should be able to build their own agents. Getting there takes the right level of controls.

He holds himself to those controls, too, turning down some of the executive passes he could have. He's also candid that access certifications are, in his words, absolutely brutal. Mapping access behaviorally, so certifications happen automatically, would be a complete game changer for him. It would make his job easier, but more importantly, he would trust the results.

Pair that with a clear chain of action, the services Saviynt provides, and secretless execution on the front end, and he sees the full life cycle covered. He would have auditability, know the intent, know what's being executed, and be able to map every action back to a person or an agent. In that model, he says, prompt injection wouldn't matter anymore.

Name it, gate it, prove it

Farshchi sees this as the moment to act. AI has the attention of every boardroom, and everyone is willing to invest. If organizations don't use this moment to get identity right, he expects a major breach tied to AI agents, followed by a pullback across the industry.

His advice to security leaders is to make machine and agent identities first-class citizens, remove copyable credentials, and drive accountability for every agent. Or, as he puts it, name it, gate it, prove it.

He sees this as a time for the industry to come together, partner, and learn so the possibilities of AI can be realized. He thanked the Saviynt team for everything it has done for Equifax.

Farshchi also joined Saviynt CEO Sachin Nayyar at Identiverse for a keynote on securing AI agents. Watch the Identiverse keynote.

Video transcript

[Music plays over the Saviynt and Equifax logos. On-screen title reads Jamil Farshchi, EVP and CTO, Equifax.]

Jamil Farshchi: When I look at the AI landscape, the transformation that all of us are undergoing right now, the number one most critical role to seeing it realize its true potential is identity, hands down.

About Equifax

At Equifax, we've been through just transformation after transformation. We decommissioned 45 data centers, nine different mainframes, thousands of refactored applications. We became a leader in security. We have roughly 1,500 agents running within our GCP environment.

The challenge

You've got to have the right guardrails in top to bottom, otherwise what's gonna happen, it'll be like our service account situation all over again. I haven't been to a company yet where you join and you try to figure out what's going on with those accounts and have any idea what is going on. They're running rampant.

Interviewer: Untouchable.

Jamil Farshchi: Yeah, they are, and you can't... Yeah, you're scared to shut 'em off 'cause you don't know what the implications are gonna be. With agents, it would be worse because these things are autonomous. You've got to have the right guardrails in top to bottom to be able to have the visibility you need, to have the accountability, to have the runtime controls. If we can do that, we unlock that promise of that agentic future, and the sky's the limit at that point.

The thing that is holding organizations back today from truly going into production and going prime time with these agents, for at least the consequential, irreversible actions, is the inability for us to be able to map chain of action between intent to execution to proof thereafter. It was in no small part to you and your organization helping us to achieve that, but then since that time, being able to maintain it as well.

AI and the future

Back in February at Equifax, we have a global leadership conference. I presented to the company the vision of everyone becoming a builder. Anyone, whether you're in marketing or HR or finance, you should be able to build your own agents. But to be able to achieve that, you've got to have the right level of controls. I disallow myself from having some of the executive passes on some of this stuff. There is nothing worse, I don't think, in my job than having to go through access certifications. It's absolutely brutal. So the promise of being able to map those, do that behaviorally so it's automatic, would be a complete game changer, not just 'cause it would make it easier for me, but because I would trust the results.

But if you marry that up with the chain that you're talking about and the services that you provide, and you tie it up with the secretless execution on the front end, then you have that full chain that I think would give me the confidence end to end that I have the auditability, I know the intent, I know what's being executed, prompt injection wouldn't matter anymore, and I have that full life cycle of it so I can map it back to the people or an agent so that we have the authorization component top to bottom throughout that life cycle.

AI identity

AI has sucked all of the oxygen out of every boardroom. Everyone is willing to invest. If we don't take advantage of this now, what's going to happen is there will inevitably be some major breach that's agent AI related, and then everyone's gonna pull back. Make sure that your machine and agent identities are first-class citizens. Focus on removing copyable credentials. Really focus on how you're going to drive agent accountability. Name it, gate it, prove it. If you can solve those areas, then I think you're gonna be in pretty good stead as it relates to identity, today and for the future.

Partnership with Saviynt

I think it's a critical time for us all to come together, partner, and learn and grow together to be able to realize the possibilities here. Thank you to you and your team for everything that you've done for us at Equifax. Thank you. I'm also on the board of UKG. You guys have done a fantastic job for them as well, a really strong partnership. We have a chance to disavow all those sins of the past. That's what excites me about this opportunity.

[Music plays over the Saviynt logo.]