Topic starter
24/06/2026 11:32 pm
TL;DR: AI agents are already operating in enterprise environments with excessive access, static API keys, and weak oversight, according to Defakto Security. Waiting for perfect discovery before governing them only extends exposure and leaves legacy controls blind to runtime behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Defakto Security: “Your AI Agents Aren’t Hidden. They’re Ungoverned. It’s time to Act”.
Key questions
Q: What breaks when AI agent discovery is incomplete?
A: When discovery is incomplete, the organisation cannot know which agents exist, what they are connected to, or what they can access.
Q: Why do static API keys create risk for AI agent access?
A: Static API keys create risk because they are long-lived, reusable, and difficult to tie to a specific action.
Q: When does AI model governance usually fail in practice?
A: It usually fails when documentation begins after deployment.
Practitioner guidance
- Prioritise the AI agents you already know about Rank visible agents by data sensitivity, production exposure, and whether they reuse static keys across multiple systems.
- Eliminate static API key sprawl first Replace copied and shared API keys with short-lived, verifiable identities for the highest-risk LLM and agent workflows.
- Instrument runtime identity telemetry Track what each agent actually accessed, which endpoints it called, and whether the actions matched the approved workload.
Bottom line: AI agents become a governance problem when they are left operating with static credentials and broad access in environments built for human users.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:28 am
Perfect discovery is the wrong governance threshold for AI agents. Security teams already have enough signal to start governing visible agents through logs, API portals, repository scanning, and secret-store inspection. The discipline changes from finding every agent to reducing the risk of the agents already in production, which is where exposure actually lives.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations contain AI agents in legacy environments?
A: Treat legacy systems as high-risk by default and narrow each agent to the minimum resources required for the workflow. Broad inherited permissions let agents overreach, even when the original intent was benign. The practical goal is to constrain blast radius before the agent can chain calls across systems.
👉 Read our full editorial: AI agent visibility fails when governance waits for perfect discovery