Topic starter
09/07/2026 3:32 pm
TL;DR: AI agents are already being adopted by 79% of organisations, while 96% of technology professionals see them as a growing risk and 98% plan to expand use within 12 months, according to CYATA’s analysis. The security issue is not model safety alone, but the absence of identity, runtime governance, and tool-chain control for actors that decide and act autonomously.
Editorial analysis by NHI Mgmt Group, based on content published by CYATA: “Why AISPM Isn’t Enough: Introducing Agentic SPM”.
By the numbers:
- 79% of organisations have adopted AI agents, according to CYATA.
- 96% of technology professionals consider AI agents a growing risk, according to CYATA.
- 98% of organisations plan to expand AI agent use within the next year, according to CYATA.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents create process risk even when the model is working well?
A: Because the model is only one part of the operating chain.
Q: How do security teams know if agent governance is actually working?
A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.
Practitioner guidance
- Define agents as governed identities Assign each agent a durable identity record that captures origin, scope, intent, and lifecycle owner so actions are attributable across systems.
- Inventory agent tool chains Map every system, API, and dataset an agent can traverse, then remove inherited access that is not required for the task path.
- Shift controls to runtime authorization Set allow, challenge, or block decisions at execution time so the agent cannot complete a sensitive tool sequence without policy enforcement.
Bottom line: Agentic security posture management exists because autonomous AI changes the governance object from model output to action-taking identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:34 pm
Agentic posture management is a control-plane response, not a model-safety extension. The article is right to separate autonomous behaviour from AISPM’s original assumptions. Model safety governs what the system says or predicts; agentic posture management governs what the system does. That distinction matters because once action is part of the design, the security boundary moves from content validation to runtime authorisation and control.
A few things that frame the scale:
- 62% of organisations are at least experimenting with AI agents, but only 23% have scaled one into a single business function, according to McKinsey's 2025 State of AI survey.
A question worth separating out:
Q: What should IAM and NHI teams do when agents inherit broad access?
A: Reduce the access path to the minimum set of systems, datasets, and APIs needed for the specific task. Then separate that access from human and service-account permissions so the agent’s reach can be observed and revoked independently. Broad inherited access is the fastest route to uncontrolled action chains.
👉 Read our full editorial: Why agentic security posture management is emerging now