Notifications
Clear all
Topic starter
24/06/2026 11:08 pm
TL;DR: 84% of organizations doubt they could pass a compliance audit focused on agent behavior or access controls, according to Strata Identity, while only 18% feel highly confident their IAM systems can manage agent identities effectively. Human-centric IAM, static credentials, and fragmented discovery are not keeping pace with agentic scale, and identity architecture now has to become contextual and continuous.
NHIMG editorial — based on content published by Strata Identity: New Survey from Cloud Security Alliance, Strata Identity Finds That Enterprises Are in a “Time-to-Trust” Phase, As They Build Foundations for AI Autonomy
By the numbers:
- 84% of organizations doubted they could pass a compliance audit focused on agent behavior or access controls.
- Only 18% of respondents say they are highly confident their current IAM systems can manage agent identities effectively.
- Only 21% of organizations maintain a real-time registry or inventory of their agents.
Questions worth separating out
Q: How should security teams govern AI agents that act across multiple tools and systems?
A: Security teams should govern AI agents as distinct identities with explicit ownership, scoped access, and runtime traceability.
Q: Why do human IAM controls struggle with agentic AI?
A: Human IAM struggles because it assumes a stable person, a predictable session, and access that can be reviewed after the fact.
Q: What breaks when organizations use static credentials for AI agents?
A: Static credentials make agent access hard to scope, hard to revoke, and hard to trace.
Practitioner guidance
- Map every agent to a named accountable owner Require one accountable business or technical owner for each agent before production use, and make that ownership visible in your identity inventory and audit evidence.
- Replace static credentials with task-scoped access Phase out long-lived API keys and passwords where an agent can complete work through contextual access, short-lived tokens, and explicit scope boundaries.
- Build a real-time agent registry Maintain a live inventory of agents, their environments, the tools they can reach, and the actions they perform so access reviews can be tied to actual behaviour.
What's in the full report
Strata Identity's full report covers the operational detail this post intentionally leaves for the source:
- Survey methodology, respondent mix, and the questions used to assess agent identity readiness.
- Breakdowns of agent adoption, confidence, and governance controls across the 285 surveyed professionals.
- The report's detailed findings on static credentials, real-time registries, and traceability across environments.
- Strata's own interpretation of how identity architecture needs to change for autonomous AI agents.
👉 Read Strata Identity's survey report on securing autonomous AI agents →
Agentic AI identity governance: what IAM teams are missing?
Explore further
25/06/2026 7:52 am
Human IAM was designed for a stable principal and a human-paced approval loop. That assumption fails when the actor is an autonomous agent because the identity can select actions, chain tools, and complete work inside a session that never maps cleanly to a manual review cycle. The implication is not simply that access controls need tuning. The governance model itself has to stop assuming that identity is observable first and active second.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who should be accountable for AI agent access decisions?
A: Accountability should sit with the team that can approve, monitor, and retire the agent, not with an inferred owner hidden in a workflow. If no one can explain why the agent exists, what it can do, and when it will be removed, the governance model is incomplete.
👉 Read our full editorial: Agentic AI identity outpaces IAM as enterprises reach time to trust
