Notifications
Clear all
Topic starter
06/07/2026 9:42 am
TL;DR: Secure agentic AI adoption is an identity and governance maturity problem, with 82% of enterprise leaders planning to deploy AI agents within three years while most organisations remain underprepared for autonomous access, according to Token Security. The real issue is not whether agents can work, but whether identity, access, and oversight models can contain independent tool use, scope drift, and shadow AI.
NHIMG editorial — based on content published by Token Security: New AI Security Guide to Secure Agentic AI
By the numbers:
- 82% of enterprise leaders plan to deploy AI agents in the next three years.
Questions worth separating out
Q: How should organisations govern AI agents that can take actions without direct human approval?
A: Treat them as governed identity subjects, not just applications.
Q: Why do AI agents create more risk than conventional automation?
A: Conventional automation follows predefined rules, while agentic systems can choose actions, tools, and timing at runtime.
Q: What breaks when shadow AI agents are not in the identity inventory?
A: Lifecycle governance breaks first, followed by ownership, certification, and offboarding.
Practitioner guidance
- Inventory every agent and its connected identities Build a continuously updated list of AI agents, service accounts, OAuth grants, API keys, and other credentials they can use.
- Map agent permissions to actual tool use Document which tools, data sources, and shells each agent can reach, then compare that access to the agent’s intended business function.
- Tie AI governance to NHI lifecycle controls Use the same ownership, certification, offboarding, and remediation discipline that already applies to service accounts and tokens.
What's in the full article
Token Security's full blog covers the operational detail this post intentionally leaves for the source:
- The four-stage maturity model with practical examples for each phase of agentic AI adoption
- Token Security's own breakdown of how discovery, governance, enforcement, and continuous compliance fit together
- The list of stakeholder groups the guide is written for, including CISOs, IAM teams, platform teams, and executives
- The source article's additional examples of where agentic AI security controls map to MCP, A2A, and OAuth integrations
👉 Read Token Security's guide to secure agentic AI adoption and maturity →
Agentic AI security maturity: what IAM teams need to change?
Explore further
06/07/2026 9:58 am
Identity maturity is now the security model for agentic AI. Agentic systems do not fit cleanly into either traditional application security or standard NHI administration because they combine runtime decision-making with credentialed access. That creates a governance problem that is broader than secrets management and narrower than generic AI risk. Practitioners should treat maturity as the organising principle because it ties discovery, ownership, enforcement, and auditability into one progression.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: How do IAM teams know whether agentic AI controls are working?
A: They should be able to answer four questions quickly: what agents exist, who owns each one, what they can access, and when those permissions were last reviewed. If any of those answers depends on manual reconstruction, the programme is operating behind the pace of deployment and is not yet defensible.
👉 Read our full editorial: Secure agentic AI adoption depends on identity maturity, not tools
