Topic starter
06/07/2026 9:42 am
TL;DR: 88% of organisations are using or plan to use AI agents, yet only 37% have moved beyond pilot programs and just 9% have integrated identity and data security controls for AI, according to Descope’s 2025 customer identity data. The gap is no longer theoretical: identity programmes are being asked to govern agent behaviour with controls built for users and static workloads.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “50+ Customer Auth Stats To Keep in Mind for 2026”.
By the numbers:
- 88% of organizations are using or plan to use AI agents, but only 37% have progressed beyond pilot programs.
- Only 9% have integrated identity and data security controls for AI.
Key questions
Q: How should security teams govern AI agents that use multiple identity layers?
A: Security teams should inventory every identity layer an agent can use, including static credentials, session identities, embedded tool identities, and any delegated relationships between agents.
Q: Why do AI agents create extra risk when they need to authenticate to other services?
A: AI agents expand risk because they often need reusable credentials to complete tasks across multiple systems.
Q: What are the signs that non-human identity controls are failing in AI-driven environments?
A: Common warning signs include long-lived credentials that are not rotated, excessive permissions on service accounts, secrets stored in code or configuration, and weak visibility into which identities are active.
Practitioner guidance
- Classify AI agents as governed identity subjects Create an explicit inventory of agents, their owners, and their approved business purpose so they are not hidden inside general application accounts or generic auth flows.
- Separate human login policy from agent authorisation Define what the human must prove at sign-in and what the agent may do after activation, with scopes documented independently from user authentication.
- Attach revocation and offboarding to agent lifecycle Require a named owner, a scope review point, and a removal path for every agent before it is allowed to touch sensitive data or external tools.
Bottom line: AI agents are becoming a governance problem faster than most identity programmes can adapt, and the gap is now visible in adoption versus control maturity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:58 am
AI agent identity is no longer a pilot problem: it is becoming a production governance problem faster than most customer identity programmes can absorb. When 88% of organisations are using or planning for AI agents but only 9% have integrated identity and data security controls for AI, the issue is not awareness. The issue is that control design is lagging runtime behaviour, and that is where trust breaks first.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat AI agents like human users in IAM?
A: No. Human IAM assumes a person logs in, works within a session, and can be reviewed later as a stable identity holder. Agents can act at machine speed, across multiple systems, and with changing runtime context, so they need identity governance built around execution and delegation rather than human authentication patterns.
👉 Read our full editorial: AI agent identity risk is outpacing enterprise auth controls