TL;DR: Credential theft and AI agent sprawl are colliding across identity programmes, with 642.4 million credentials stolen from infostealer infections in 2025 and 56% of non-human identities sitting outside structured governance, underscoring how legacy IAM controls are no longer enough when identities, applications and agents must be governed continuously, according to Josys.
At a glance
What this is: Josys outlines how credential theft and unmanaged AI agents are exposing the limits of legacy identity governance, with record-scale theft and governance gaps converging in the same control plane.
Why it matters: IAM, IGA and NHI teams need to treat leaked credentials and AI agent sprawl as one governance problem because point tools and periodic reviews cannot keep pace with continuous identity exposure.
By the numbers:
- 642.4 million credentials were stolen from infostealer infections in 2025 alone, according to SpyCloud research cited by Josys.
- 56% of non-human identities sit entirely outside structured governance, according to Gartner research cited by Josys.
Context
Credential theft and AI agent sprawl are now colliding inside the same identity programme. The problem is not just that access is compromised more often. It is that many organisations still govern users, applications and AI agents through separate processes that were never designed to see the full identity attack surface at once.
For identity teams, the real gap is governance continuity. Static reviews, disconnected alerting and manual remediation do not scale when leaked credentials can be used immediately and AI agents can appear, change scope and persist outside ordinary access review cadences.
Key questions
Q: What should teams do first when leaked credentials are discovered in active identities?
A: Treat the exposure as a live access event, not a forensic note. Correlate the leaked credential to the identity’s current application reach, revoke the exposed access paths, and then review whether the identity still needs those entitlements. The first objective is to shrink the blast radius before the credential is reused.
Q: Why do AI agents need special governance compared with normal applications?
A: AI agents make decisions about which tools to use and how to use them, so they can be manipulated by malicious context as well as code. That creates an NHI risk because the agent itself has delegated execution authority. Governance must cover identity, metadata trust, and action policy, not only authentication.
Q: Where do periodic access reviews fail in SaaS-first identity programmes?
A: They fail when access, policy and configuration drift faster than the review cadence can observe. In SaaS-first environments, an entitlement can be created, expanded or misconfigured long before the next certification cycle. Continuous enforcement catches that drift at the moment it appears, which is when governance still has leverage.
A: Governing AI agents as users usually misses the operational reality that they are automated entities acting across systems, not people following a fixed workflow. Treating them as non-human identities forces clearer controls for authentication, authorization, task scoping, logging, and revocation. That model better fits machine-run access and makes it easier to apply least privilege consistently.
How it works in practice
Why leaked credentials break legacy identity controls
Stolen credentials turn identity governance into a timing problem. Once credentials are harvested from infostealer logs, dark web forums or paste sites, the attacker is using legitimate authentication material rather than exploiting the application directly. That means access reviews, ticket-based revocation and periodic recertification often happen after the damage window has already opened. The article’s core point is that identity telemetry has to move earlier in the chain, from discovery after compromise to exposure monitoring before use. Practical implication: treat leaked credentials as active access events, not future audit findings.
Practical implication: Move detection and revocation to exposure time, not the next review cycle.
How AI agent governance differs from application inventory
AI agents are not just another SaaS object in the catalogue. They are identity-bearing actors that can hold access, perform actions and operate across systems, which means governance must include inventory, ownership, entitlement mapping and policy enforcement. The article stresses that many agents remain invisible because they are deployed outside traditional application approval flows. That creates a governance blind spot where the organisation can describe its software estate but still not know which autonomous actors are acting with privilege. Practical implication: inventory agents as identities, not as generic tools.
Practical implication: Track AI agents as governed identities with owners, scopes and approvals.
Why continuous policy enforcement replaces periodic review
Periodic manual governance assumes that access changes slowly enough for humans to catch drift. In a SaaS-first environment, that assumption fails because settings, entitlements and identity relationships can change continuously across many applications and tenants. Continuous policy enforcement closes that gap by checking state in real time and triggering remediation when policy is violated. That is a different operating model from batch review because it treats governance as an always-on control rather than a reporting exercise. Practical implication: use policy engines to enforce identity rules continuously across all applications.
Practical implication: Replace batch certifications with always-on enforcement and automatic remediation.
NHI Mgmt Group analysis
Credential exposure is now a governance event, not just a security alert. When leaked credentials can be matched to live access and remediated automatically, the boundary between threat detection and identity governance collapses. Organisations that still treat exposure as a ticket to work later are governing the wrong moment in the lifecycle. The practical conclusion is that exposure monitoring belongs inside identity governance, not beside it.
AI agent inventory is now an access-control requirement, not a discovery nice-to-have. The article shows that AI agents can sit outside structured governance while still holding meaningful access. That means the central governance question is not whether an agent exists, but who owns it, what it can reach and whether its privilege is continuously bound to policy. Practitioners need agent-level accountability before they can claim governance.
Continuous enforcement is the only credible response to SaaS-era identity drift. Manual review assumes entitlement state is stable long enough to be certified, but SaaS sprawl and multi-tenant operations break that assumption. Josys is pointing at a broader market shift: governance now has to behave like runtime control, not quarterly administration. The implication is that identity programmes must measure enforcement latency, not just review completion.
Legacy IGA assumptions were built for static human directories, not for identities that appear, expand and disappear continuously. That assumption fails when AI agents and leaked credentials create identity states that change faster than governance cycles can observe. The implication is a redesign of governance scope: practitioners must govern the full identity set, including machines and agents, as one control problem.
Identity blast radius is now the right concept for programme design. The article ties stolen credentials, unmanaged agents and policy drift to the same operating problem: an identity can now spread access, risk and remediation burden across multiple applications at once. Practitioners should use blast-radius thinking to prioritise which identities deserve real-time controls first, especially where SaaS and MSP tenancy multiply the impact.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Top 10 NHI Issues
What this signals
Identity governance is shifting from periodic certification to exposure-time control. When stolen credentials and AI agents are changing the attack surface continuously, the programme that waits for the next review is already behind. Practitioners should expect governance metrics to move toward remediation latency, policy drift and identity visibility rather than completion counts.
Exposure monitoring and NHI governance now need the same operational plane. A credential leak is no longer just a threat-intel event if the identity can still act across SaaS applications. Teams should align their monitoring, revocation and ownership model so that leaked access and unmanaged agents are handled as one continuous control problem.
For practitioners
- Map identity exposure to live application access Correlate leaked credentials from stealer logs, paste sites and dark web sources to the accounts and applications those identities can still reach, then revoke exposed access before manual review cycles catch up.
- Inventory AI agents as governed identities Create a canonical register for agents with ownership, purpose, approved scopes, connected systems and policy status so that AI agents are visible in the same control plane as human and machine identities.
- Shift from periodic certification to continuous enforcement Use real-time policy checks to detect entitlement drift, misconfiguration and unauthorised access changes across SaaS applications, then trigger automated remediation when the policy boundary is crossed.
- Unify MSP and enterprise remediation workflows Where third-party operators manage multiple tenants, standardise alert aggregation, role ownership and revocation workflows so one analyst can contain exposure without context-switching across customer environments.
Key takeaways
- Credential theft and unmanaged AI agents are converging into one identity governance problem that older IAM models do not handle well.
- The article’s evidence points to record-scale stolen credentials and large numbers of non-human identities outside structured governance.
- Teams need continuous exposure monitoring, identity inventory and real-time policy enforcement to reduce the blast radius of both leaks and AI agent sprawl.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The article centers on leaked credentials being discovered and remediated. |
| NHI-05 — Overprivileged NHI | AI agents and machine identities are described as holding access beyond structured governance. | |
| NHI-10 — Human Use of NHI | The article emphasizes governance spans humans, machines and AI agents in one control plane. | |
| Recommendation — Scan for leaked NHI secrets and revoke exposed access before attackers reuse them. Reduce NHI blast radius by tightening scopes and removing excess entitlements. Separate human and non-human workflows so machine access is not managed as user access. | ||
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | AI agents are presented as identity-bearing actors with privileged access outside governance. |
| Recommendation — Bind agent privilege to ownership, scope and policy so runtime access cannot drift unchecked. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing entitlements across identities and agents. |
| Recommendation — Continuously validate entitlements and revoke access that no longer matches policy. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Stolen credentials and downstream reuse are the core threat path described in the article. |
| Recommendation — Map leaked credentials to credential access and lateral movement detections in your pipeline. | ||
Key terms
- Identity Exposure Path: An identity exposure path is the sequence of systems, permissions, and trust relationships that can be used to reach sensitive identities or their privileges. It describes how an attacker, insider, or misconfiguration could move from one identity control point to another, revealing where identity risk becomes exploitable across accounts, tokens, sessions, and access policies.
- AI Agent Governance: AI Agent Governance is the set of policies, controls, and oversight practices used to direct how autonomous software agents behave. It defines allowed actions, approval paths, identity boundaries, logging, monitoring, and accountability so agent decisions remain traceable, constrained, and aligned with business, security, legal, and ethical requirements.
- Continuous enforcement: Continuous enforcement means access rules, monitoring, and revocation are applied in near real time rather than during scheduled reviews. For AI and other non-human identities, it is the only model that matches how quickly identities can be created, changed, and abused. It turns security from periodic approval into ongoing control.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org