Topic starter
24/06/2026 10:46 pm
TL;DR: Agentic AI is moving from experimental to operational as systems begin initiating workflows, accessing systems, and modifying data without direct human prompting, while 69% of cybersecurity professionals expect AI-based vulnerabilities to outpace human misuse of AI, according to Keyfactor. Conventional automation controls were built for scripts, not actors that make decisions at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “What Is Agentic AI Security? Governing Autonomous AI in the Enterprise”.
By the numbers:
- 69% of cybersecurity professionals said AI-based vulnerabilities will pose a greater threat than human misuse of AI in the coming year.
Key questions
Q: What breaks when organisations treat agentic AI like ordinary automation?
A: They often miss that autonomous systems can decide timing, sequence, and tool choice at runtime.
Q: Why do autonomous AI systems create more identity risk than normal automation?
A: Normal automation follows a fixed path, but autonomous systems can interpret goals, choose actions, and continue without waiting for a person.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define AI agents as governed identity subjects Inventory where autonomous systems can initiate actions, access data, or call tools, then assign ownership, approval paths, and accountability to each agent class.
- Constrain runtime access paths Limit agents to approved tools, approved data scopes, and approved delegation paths so action sequences cannot expand silently during execution.
- Add traceable authentication and logging Require machine-verifiable identity, signed actions where possible, and logs that preserve the agent, the delegation chain, and the exact runtime decision trail.
Bottom line: Agentic AI changes the security problem by turning runtime decision-making into an identity issue, not just an automation issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:35 am
Agentic AI security is really an identity governance problem, not just an AI problem. The article correctly frames trust, accountability, and access as the core issues because autonomous systems act inside enterprise environments, not outside them. That means IAM, PAM, and lifecycle governance now apply to AI agents as governed actors rather than as mere automation. Practitioners should treat agentic AI as an identity class with its own control expectations.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations add continuous controls for AI agents?
A: Organisations should add continuous controls as soon as an agent can select tools, act across systems, or delegate to other non-human identities. Those capabilities create runtime drift and delegation risk that periodic certification cannot see fast enough. Continuous oversight becomes necessary once the agent can change its own action path.
👉 Read our full editorial: Agentic AI security is redefining identity, trust, and governance