Topic starter
24/06/2026 11:13 pm
TL;DR: A survey of 450 cybersecurity professionals finds 86% say AI agents need unique, dynamic digital identities to be trusted, while 69% see agent vulnerabilities as a bigger risk than human misuse and only 28% believe they can prevent rogue-agent damage, according to Keyfactor and Wakefield Research. The gap is no longer theoretical: identity, auditability, and revocation have to move in front of autonomous execution.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Keyfactor Research Reveals Two-Thirds of Companies Say AI Agents Are a Bigger Security Risk Than Humans”.
By the numbers:
- 86% of cybersecurity professionals say AI agents and autonomous systems cannot be fully trusted without unique, dynamic digital identities.
- 69% of cybersecurity professionals believe vulnerabilities in AI agents and autonomous systems pose a greater threat than human misuse of AI.
- 85% of cybersecurity professionals expect digital identities for AI agents will be as common as human and machine identities within five years.
Key questions
Q: What breaks when digital IDs are missing for AI agents?
A: Without a durable identity for each agent, organisations lose the ability to track permissions, correlate actions to a specific actor, and retire access cleanly.
Q: Why do autonomous AI systems increase security risk compared with human misuse?
A: Autonomous systems can initiate actions, repeat them quickly, and interact with other systems without waiting for a human decision at each step.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Define unique agent identities Assign every AI agent a distinct identity, lifecycle owner, and revocation path so behaviour can be attributed to a specific actor rather than a shared workload label.
- Bind actions to cryptographic provenance Record which agent, session, and code path produced each significant action so investigation, approval, and rollback can rely on evidence rather than inference.
- Set enforceable runtime boundaries Constrain tool access, data reach, and delegation depth so an agent cannot expand its scope beyond the authorisation context in which it was issued.
Bottom line: AI agents change the identity problem because they can act autonomously, not just authenticate like ordinary software.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:58 am
Dynamic identity is now a prerequisite for agent trust: An AI agent that can initiate actions, select tools, and interact with other agents cannot be governed by identity assumptions designed for passive software. The field has moved from authenticating a requester to governing an actor that can change state mid-session. The practitioner implication is that identity has to describe runtime behaviour, not just static entitlement.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: How should security teams govern scheduled AI agents across IAM, PAM, and NHI programmes?
A: Treat each routine as an identity with an owner, a narrow scope, an expiry path, and an approval boundary for any irreversible action. Then apply the same lifecycle discipline you would use for other non-human identities: inventory, scoping, review, and offboarding. If it can run unattended, it needs unattended governance.
👉 Read our full editorial: AI agent identity risk is outpacing enterprise trust models