TL;DR: C1.ai’s 2025 Future of Identity Security report finds that 89% of security leaders plan to use AI agents within two years, while 83% are concerned about the risks and 96% expect deployments to extend beyond non-critical tasks. The gap is not enthusiasm versus caution, but governance that has not yet caught up with agentic access decisions.
At a glance
What this is: This survey shows security leaders accelerating AI agent adoption even as identity risk, over-privilege, and governance pressure remain unresolved.
Why it matters: IAM, IGA, PAM, and NHI teams need to treat agentic access as a live governance problem because deployment momentum is moving faster than control design.
By the numbers:
- 89% of respondents plan to use AI agents in their security departments within the next two years.
- 83% of respondents say they are concerned about the risks posed by agentic AI.
- 96% of respondents say their planned agentic AI deployments will not be limited to non-critical tasks.
- 93% of security leaders believe the risks associated with NHIs are urgent.
👉 Read C1.ai's survey on AI agents and identity risk in security teams
Context
AI agent adoption is moving into security operations before most organisations have settled the governing rules for access, accountability, and containment. In identity security terms, that matters because an AI agent is not just another automation layer; it is an actor that can request, use, and combine access in ways traditional review cycles were not built to evaluate. This is why the primary question is not whether agents will be used, but how their identity and privilege will be governed once they are.
C1.ai’s survey shows a familiar pattern: operational pressure, executive advocacy, and a desire for speed are all pushing AI agents deeper into identity workflows. The governance gap is not theoretical. The article also shows that NHI risk is already being treated as urgent by most respondents, which places workload identity, lifecycle control, and privileged access scope at the centre of the discussion.
The key issue for practitioners is that the same organisations accelerating agentic adoption are also acknowledging higher identity risk and a need for stronger security outcomes. That combination usually means controls are being asked to stretch across more identities, more workflows, and more delegated decisions without a matching redesign of policy, ownership, and evidence generation.
Key questions
Q: What breaks when AI agent governance is treated as access control?
A: The control boundary breaks first. Governance tools can document what an agent is supposed to do, but they cannot stop the agent from authenticating, requesting privileges, or calling systems unless a separate runtime IAM layer enforces those decisions. That leaves a gap between policy intent and actual containment.
Q: Why do AI agents increase non-human identity risk?
A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission. That speed expands blast radius, shortens attacker dwell time, and makes weak delegation more dangerous. The remedy is tighter scoping, continuous verification, and strict separation between observation and execution privileges.
Q: How do security teams know if an AI agent has too much access?
A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores. A healthy deployment leaves a clear audit trail of what the agent can do, what it actually did, and which credentials it used.
Q: Should organisations prioritise AI agent use in security operations or identity cleanup first?
A: Identity cleanup should come first when the environment already has over-privilege, unclear ownership, or fragmented access records. AI agents will amplify whatever governance model they inherit, so scaling them before reducing entitlement noise usually increases operational speed without improving control.
Technical breakdown
Why agentic access changes the identity control model
AI agents complicate identity governance because access is no longer only tied to a person, a workload, or a static service account. An agent can initiate actions at runtime, request additional scope, and participate in workflows where timing and intent are fluid. That breaks the assumption that privilege can be fully understood at provisioning time. In practice, this pushes identity teams toward runtime authorisation, tighter scope boundaries, and clearer accountability for delegated action.
Practical implication: design access governance around the agent's runtime behaviour, not just its initial entitlements.
Why high-friction security tasks are attracting AI agents
The article highlights network monitoring, SOC automation, and access requests as leading use cases because these are repetitive, high-volume, and delay-sensitive. Those traits make them attractive candidates for AI assistance, but they also create governance pressure. Once an agent can participate in approvals, triage, or access fulfilment, identity control must account for who authorized the action, what data the agent consumed, and whether the resulting privilege was still appropriate for the task.
Practical implication: put approval, traceability, and task scoping controls in place before AI agents enter operational security workflows.
How over-privilege and complexity amplify AI agent risk
The report links identity compromise, over-privileged users, and system complexity to rising urgency around IAM. That matters because AI agents are often introduced into the same fragmented environments that already struggle with access sprawl. If the surrounding identity estate is unclear, agents inherit ambiguity instead of reducing it. The result is not simply more automation, but more automated access operating inside a poorly bounded entitlement model.
Practical implication: reduce entitlement sprawl and improve identity visibility before expanding AI agent use beyond low-risk tasks.
Threat narrative
Attacker objective: The practical attacker objective is to exploit agent-enabled trust and privilege pathways to accelerate access abuse or widen the blast radius of identity compromise.
- Entry occurs when AI agents are granted broad operational access into security workflows and identity processes without a mature governance baseline.
- Privilege escalation follows when those agents are allowed to participate in access requests, account provisioning, or other workflows that can expand their effective scope.
- Impact emerges when agentic decisions are made inside complex identity estates where over-privilege and poor visibility can turn speed into uncontrolled access.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Agentic identity governance is now a present-tense control problem, not a future architecture question. The survey shows adoption intent rising even while risk concerns remain high, which means organisations are making identity decisions under operational pressure. That combination typically produces delegated access before delegated accountability, especially where security teams want AI to absorb high-friction work. The practitioner implication is that agentic access policies need to be designed before deployment scales.
Least privilege becomes harder to define once the actor can act at runtime. In a human or static workload model, access scope can be documented ahead of time and recertified later. An AI agent can change the shape of its access use within the task itself, which means the traditional assumption that entitlements remain stable long enough to review starts to fail. The implication is that governance must move from static privilege snapshots to runtime-authorised scope control.
Identity complexity is the real force multiplier behind agentic AI risk. The article’s broader message is not that AI agents create identity problems from nowhere, but that they inherit unresolved ones from fragmented IAM estates. When over-privilege, unclear ownership, and poor visibility already exist, an agent simply accelerates the consequences. Practitioners should treat agentic AI as a stress test for existing identity architecture, not a reason to delay basic governance.
Ephemeral trust debt: AI agents accumulate privilege assumptions faster than access reviews can clear them. Because the survey points to non-critical use cases expanding into operational workflows, the control question is no longer whether the agent can work, but whether its trust boundary can be made auditable. That is the governance gap identity teams now have to close.
The security function is outsourcing speed faster than it is redesigning accountability. Boards and executives are pushing AI adoption, but the article also shows strong concern about risk. That tension usually leads to delegated decisions without equally mature evidence trails. The implication is that identity programmes must prove who approved agent access, what scope was granted, and how exceptions are governed.
From our research library:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Security leaders are not delaying agent adoption, so identity teams have to govern it as an active rollout problem. The practical implication is that agentic access cannot wait for a perfect operating model. If boards and security leaders are already pushing deployment, identity teams need an explicit policy for scope, approval, logging, and offboarding before those agents are embedded in production workflows.
Runtime scope control matters more than static role assignment for AI agents. Once an agent can participate in approvals, provisioning, or monitoring, its risk profile is defined by what it can do during execution, not by a job title or a one-time entitlement grant. That shifts programme design toward task-scoped access, evidence capture, and rapid revocation when behaviour drifts.
AI agent risk is becoming a governance signal, not just a technology trend. In the 2026 Infrastructure Identity Survey, only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap tells practitioners the market is moving faster than policy design, so the next control question is whether agent authority can be measured and contained before it becomes routine.
For practitioners
- Define agent-specific access boundaries Treat AI agents as governed identities with explicit task scope, target systems, and revocation conditions instead of broad operational access.
- Separate low-risk experiments from operational workflows Limit early AI agent use to tightly bounded scenarios while keeping access requests, provisioning, and monitoring under human-controlled policy.
- Map agent permissions to business tasks Tie each agent permission set to a named workflow so access can be reviewed against a concrete purpose rather than an assumed role.
- Instrument agent actions for audit and rollback Capture decision logs, approvals, and downstream access changes so security teams can reconstruct what an agent did and reverse it quickly.
- Reduce identity sprawl before scaling agents Clean up over-privileged human and non-human accounts first, because unresolved entitlement noise will be inherited by any agentic workflow.
Key takeaways
- AI agents are moving into security workflows faster than most identity governance models are adapting, which creates a control gap around delegated access and accountability.
- The biggest risk is not AI adoption itself but the way it inherits over-privilege, fragmented ownership, and weak scope control from existing IAM estates.
- Practitioners should treat agentic access as a governed identity problem first and a productivity capability second, with scope, logging, and revocation designed up front.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on AI agents expanding into privileged security workflows. |
| Recommendation — Constrain agent privileges to task-scoped approvals and monitor for identity abuse at runtime. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The survey highlights over-privilege and broad agent access as core risks. |
| NHI-10 — Human Use of NHI | Security leaders are considering agents inside human security workflows and approval paths. | |
| Recommendation — Review agent entitlements for overprivilege and shrink any access that is not tied to a named task. Separate human approval boundaries from agent execution paths so NHI use does not collapse into human misuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The issue is how AI agent permissions are granted and constrained across identity workflows. |
| Recommendation — Apply PR.AA-05 to keep agent entitlements explicit, reviewable, and limited to intended access paths. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Over-privileged agents can widen access and move laterally across identity-managed systems. |
| Recommendation — Map agent privilege abuse to TA0006 and TA0008 to prioritise detection around exposed access paths. | ||
Key terms
- AI Agents: AI agents are autonomous software entities that act within organisational environments and make runtime decisions within assigned boundaries. They can hold identities, authenticate to systems, and exercise permissions, which makes them comparable to other non-human identities that require inventory, governance, and continuous activity monitoring.
- Agentic Access: Agentic access is delegated system access granted to an AI agent or autonomous workflow so it can perform defined tasks across tools and data sources. It differs from human access because the actor can execute continuously, combine actions quickly, and amplify mistakes at scale.
- Privilege Scope: Privilege scope is the set of actions, data, and tools an identity is allowed to use. For AI agents, scope must be defined around the task and the acceptable blast radius, because broad or persistent privileges can turn a small mistake into a production-level incident.
- Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
What's in the full report
C1.ai's full survey post covers the operational detail this post intentionally leaves for the source:
- The full survey breakdown of AI agent adoption plans across security teams and leadership pressure points
- Methodology details from a survey of 494 U.S.-based IT security leaders at companies with 500 or more employees
- The article's full breakdown of identity attack pressure, NHI urgency, and the top AI security use cases
- The vendor's complete summary of how respondents are balancing AI adoption with identity risk and IAM budget growth
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org