Notifications
Clear all
Topic starter
09/07/2026 3:30 pm
TL;DR: AI agents are already performing business tasks with elevated privileges, according to CYATA, and PwC’s May 2025 survey shows 79% of companies use agents while 66% report measurable productivity gains. The real gap is not model quality but identity, access, and accountability for actors that can call tools and make decisions independently.
NHIMG editorial — based on content published by CYATA: Agentic AI identity governance and the rise of autonomous privilege
By the numbers:
- 79% of companies report that AI agents are already in use in their organizations, and 66% of those say they are already generating measurable productivity gains.
Questions worth separating out
Q: How should security teams govern AI agents that can take real actions in enterprise systems?
A: Treat them as identity subjects with runtime authority, not as passive automation.
Q: Why do agentic AI systems complicate traditional IAM and PAM models?
A: Because IAM and PAM were designed around human-paced approvals and static entitlement review.
Q: What breaks when AI agents are managed like ordinary service accounts?
A: Accountability breaks first, then scope control.
Practitioner guidance
- Inventory every AI actor with enterprise access Discover copilots, autonomous coding assistants, orchestration agents, and any AI system that can call internal or SaaS tools.
- Model agent access as action chains, not isolated entitlements Review the full path from identity credential to tool invocation to downstream data access.
- Add runtime accountability to delegated access Log the agent’s decision path, tool choices, and execution timing so post-incident review can reconstruct why an action occurred.
What's in the full article
CYATA's full article covers the operational detail this post intentionally leaves for the source:
- The vendor's reasoning on why privilege, not model quality, is the central security boundary for agentic AI.
- The specific control-plane features Cyata describes for discovering and governing agent identities across SaaS and local environments.
- The company’s view on how JIT access and human oversight can be applied to autonomous agents in practice.
- The PwC survey framing and broader market adoption context behind the article's urgency.
👉 Read CYATA's analysis of agentic AI identity governance and privilege →
Agentic AI identities: what IAM teams are missing today?
Explore further
09/07/2026 3:51 pm
Agentic AI is not a model governance problem first, it is an identity governance problem first. The article is right to move the discussion away from outputs and hallucinations, because the security event is the action itself. Once an AI system can choose tools and timing independently, the access decision becomes a runtime identity event, not a static policy event. IAM and PAM teams should treat agent behaviour as governed execution, not as a dressed-up workflow.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- The average estimated time to remediate a leaked secret is 27 days, even though 75% of organisations say they are confident in their secrets management capabilities.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unauthorised action?
A: The organisation remains accountable, but operational responsibility should be explicit before deployment. Practitioners need a named owner, documented delegation boundaries, and a review process that records the agent’s runtime decisions, otherwise incident investigation becomes a search for missing context.
👉 Read our full editorial: Agentic AI identity governance is exposing IAM blind spots
