AI readiness is lagging behind adoption in enterprise IT

At a glance

What this is: This report says AI adoption is now almost universal, but readiness has not caught up, leaving IT teams with a widening governance gap around identity, access, and shadow AI.

Why it matters: It matters because IAM, NHI, and AI governance teams now have to control human users, bots, and AI agents inside one access model instead of treating AI as a separate layer.

By the numbers:

• 99.6% of organisations are now using or planning to use AI.
• 60% of IT professionals say that AI is outpacing their ability to protect against threats.
• 61% of organisations frequently encounter shadow AI.
• 85% of IT leaders agree that secure IAM practices are critical for successful AI adoption.

Context

AI readiness is the ability of an identity and security stack to support AI safely, not just the willingness to deploy AI tools. JumpCloud’s report frames the problem as a gap between adoption speed and the access controls needed to govern humans, bots, and AI agents consistently.

That gap matters because shadow AI and fragmented access remove visibility from the IAM programme. When identity is split across tools, teams lose the ability to distinguish who or what is accessing data, revoke access quickly, or apply least privilege across endpoints, SaaS applications, and AI agents.

Key questions

Q: What breaks when AI adoption outpaces governance?

A: What breaks first is attribution. Teams lose visibility into which tools are in use, which data they can reach, and which actions were taken automatically versus manually. Once adoption is ahead of control design, security teams end up retrofitting policy around live workflows instead of governing them from the start.

Q: Why do shadow AI tools create risk for IAM teams?

A: Shadow AI complicates IAM because the real subject is often not just the employee, but the AI service, token, or connector acting on the employee's behalf. That expands the identity surface without formal provisioning, certification, or offboarding, which means access governance becomes incomplete even when human login controls are strong.

Q: How should security teams govern AI agents that inherit authority from other identities?

A: Security teams should govern AI agents by tracking identity lineage, not just credentials. That means recording the originating identity, the delegated authority path, and the runtime context for each action. If an agent can inherit permissions from humans, services, or other agents, policy has to evaluate the full chain before access is granted or continued.

Q: Should organisations rework IAM when AI systems begin to act on data?

A: Yes, because AI-connected workflows turn permissions into a runtime risk. IAM teams need to review delegated access, enforce least privilege, and make sure entitlements are traceable to an accountable owner. Without that, AI systems can inherit access that was never designed for autonomous or semi-autonomous use.

Technical breakdown

Why unified identity becomes the control plane for AI access

AI changes the access model because the subject requesting, using, or combining privileges is no longer always a human user. Unified identity management becomes the control plane when organisations need one place to enforce authentication, authorisation, and revocation across devices, SaaS apps, and AI-driven workloads. The article’s core point is that fragmented tools create blind spots, so governance fails first at visibility and then at enforcement. Once AI agents participate in workflows, access can no longer be treated as a single-user problem.

Practical implication: map AI access into the same IAM governance model used for human and machine identities.

Shadow AI and the identity visibility problem

Shadow AI is not just unsanctioned software use. In identity terms, it is unmanaged access activity that sits outside approved inventory, policy, and review cycles. When IT cannot see the account, token, or agent behind an action, it cannot apply recertification, least privilege, or revocation in a disciplined way. The risk is not only data leakage. It is the loss of authoritative identity context across the environment, which makes every downstream access decision weaker.

Practical implication: establish inventory and ownership for AI tools and the identities they use before expanding adoption.

Why AI agents turn least privilege into a live governance issue

Least privilege is harder to preserve once AI agents are independently executing tasks because privilege use becomes dynamic, time-bound, and harder to attribute to a single operator. The article points to the need to govern non-human identities with the same rigor as human users, which means access cannot remain implicit or loosely delegated. In practice, privilege scope, revocation speed, and auditability become the meaningful controls, because the agent can act faster than manual review cycles.

Practical implication: treat AI agents as governed identities with explicit entitlements, logging, and revocation paths.

Threat narrative

Attacker objective: The objective is to exploit fragmented access and unmanaged AI identities to obtain unauthorised privilege and access data or systems beyond intended scope.

1. Entry begins with sanctioned or unsanctioned AI adoption inside fragmented IT environments, where identity boundaries are already inconsistent.
2. Credential or privilege exposure follows when AI tools, bots, or agents inherit access without unified visibility or ownership.
3. Escalation occurs when an AI agent or shadow AI workflow operates with more privilege than the task requires, creating unauthorized access paths.
4. Impact is loss of control over who or what accessed data, along with higher exposure to threats, shadow usage, and privilege abuse.

Breaches seen in the wild

• JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Unified identity is now the minimum viable security model for AI adoption. The article correctly shows that readiness is not the same as enthusiasm, and that distinction is now central to IAM planning. When AI is adopted faster than access governance, identity becomes the first control plane to fail, because policy can no longer be enforced consistently across people, bots, and agents. Practitioners should treat unification as the operating assumption, not an optimization.

Shadow AI is an inventory failure before it is an AI failure. Frequent unsanctioned use means organisations are already losing sight of the identities, tokens, and permissions behind AI-driven activity. That is an NHI governance problem as much as an AI problem, because access outside inventory cannot be certified, offboarded, or constrained with confidence. The practitioner takeaway is that discovery and ownership are now core readiness requirements.

Least privilege for AI agents is an entitlement design problem, not a policy slogan. The article’s strongest signal is that AI agents introduce faster, more distributed execution than human workflows, which makes standing access more dangerous. If privilege is still granted as though all actors are static and reviewable on a human cadence, governance breaks at runtime. Teams must redesign entitlements for non-human execution paths, not merely document them.

AI readiness will increasingly be measured by governance consistency, not deployment volume. JumpCloud’s data shows that adoption is nearly universal, but security confidence is not. That tells the market that the next maturity divide is between organisations that can govern identity across heterogeneous actors and those that cannot. The practical implication is that programme maturity will be judged by enforcement coherence, not by AI rollout speed.

The market is moving from AI experimentation to AI accountability. Once AI becomes routine, the question is no longer whether it can improve productivity, but whether identity and access controls can keep pace with autonomous execution and shadow usage. That shifts the centre of gravity from tool selection to governance architecture. Practitioners should expect buyers, auditors, and internal risk teams to ask how AI identities are inventoried, constrained, and revoked.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Read next: Identity Convergence Guide

What this signals

AI readiness is becoming an identity governance test, not a tooling test. The organisations most exposed are not the ones using AI first, but the ones using it without a single access model that can see humans, bots, and agents together. For identity teams, that makes unified control the practical boundary between adoption and governability.

Shadow AI is the operational signal that inventory and ownership have drifted apart. Once unsanctioned tools are common, recertification, revocation, and least privilege stop covering the full access surface. The programme response is to treat AI identities and tool usage as governed assets, not incidental by-products of innovation.

For practitioners

• Consolidate identity governance around one control plane Use a unified identity model to enforce authentication, authorisation, and revocation consistently across endpoints, SaaS applications, and AI agents.
• Inventory shadow AI and its identities Catalogue sanctioned and unsanctioned AI tools, then identify the accounts, tokens, or service identities each tool uses so they can be owned and reviewed.
• Apply least privilege to AI agents Define explicit entitlements for AI agents, remove broad inherited access, and make revocation fast enough to stop rogue execution paths.
• Rebuild access reviews for non-human actors Shift from human-centric recertification cadences to governance that checks AI and bot identities at issuance, not only at periodic review.

Key takeaways

• AI adoption is already widespread, but the report shows that readiness, visibility, and governance are still lagging behind.
• The central control issue is not whether AI works, but whether identity teams can inventory, constrain, and revoke access for humans, bots, and AI agents consistently.
• Unified identity is now the baseline requirement for safe AI adoption because fragmented access makes shadow AI and privilege abuse harder to contain.

Key terms

• AI readiness: AI readiness is the state where an organisation can deploy AI systems without losing control of identity, access, and auditability. It goes beyond adoption or enthusiasm and asks whether the environment can govern AI tools and agents across the full stack, including data, devices, and lifecycle processes.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Unified Identities: Unified identities are a consolidated view of duplicate, fragmented, or inconsistent identity records across platforms. The goal is to connect aliases, ownership, privileges, and activity into one trustworthy record so teams can govern access more accurately and spot hidden risk.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.