Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: AI-era identity security is moving faster than governance, and Veza cites a CSA survey showing only 26% of organisations have comprehensive AI security policies in place, while the updated OWASP Top 10 for LLM Applications signals a shift toward agent-centric risk. The practical issue is that least privilege and access control must now account for AI agents as governed identities, not just workloads.
NHIMG editorial — based on content published by Veza: Operationalizing the OWASP Top 10 for LLMs: Securing The Identity Control Plane
By the numbers:
- Only 26% of organisations report having comprehensive AI security governance policies in place.
- The updated OWASP Top 10 for LLM Applications indicates a significant shift in cybersecurity centered on AI agents.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams govern AI agents that can change behaviour at runtime?
A: Security teams should govern AI agents with runtime monitoring, behavioural baselines, and identity-triggered response, not just static approval workflows.
Q: Why do AI agents complicate least privilege for IAM programmes?
A: AI agents complicate least privilege because their access is task-driven and may change during execution.
Q: What do IAM teams get wrong about agent users and human users?
A: They often assume that a user-shaped object means a human-style identity process.
Practitioner guidance
- Define a governed owner for every AI agent Assign business and technical ownership before an agent receives tool access, and require a revocation path that can be executed without dependency on the model runtime.
- Inventory the effective tool chain Document every connector, API, retrieval source, and delegated system an agent can reach, then review the full chain for privilege expansion beyond the assigned role.
- Bind policy to access lifecycle controls Connect AI policy to onboarding, access review, monitoring, and offboarding events so approvals and revocations are enforceable rather than advisory.
What's in the full article
Veza's full whitepaper covers the operational detail this post intentionally leaves for the source:
- How the platform frames identity security as the control plane for AI agents and LLM access
- The specific least-privilege strategies it recommends for agent identities at scale
- The survey context behind the 26% AI security governance figure and what it implies for programme maturity
- How its NHI and AI agent security capabilities are positioned across access visibility, monitoring, and governance
👉 Read Veza's white paper on operationalising the OWASP Top 10 for LLMs →
AI agent identity governance: what practitioners need to tighten now?
Explore further
25/08/2026 6:11 pm
AI agents should be governed as identities before they are governed as applications. Once an agent can authenticate, call tools, and access data on its own behalf, the relevant control question shifts from software assurance to identity assurance. That creates a direct overlap with NHI governance, because the access path behaves like any other non-human identity with runtime privileges. Practitioners should treat agent identity as part of the core identity estate, not a sidecar concern.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations use a dedicated AI agent identity model or extend current NHI controls?
A: Extend current NHI controls first, but only if they include ownership, scope, lifecycle, and revocation discipline. The mistake is treating AI agents as just another service account when they may combine permissions dynamically at runtime. A dedicated model is warranted when delegation chains span multiple applications and control ownership is unclear.
👉 Read our full editorial: AI agent identity governance is lagging behind security policy
