Topic starter
24/06/2026 11:13 pm
TL;DR: 86% say AI agents need unique, dynamic digital identities to be trusted, in Keyfactor and Wakefield Research's survey of 450 cybersecurity professionals. IAM and NHI programmes now have to account for autonomous actors that need proof, limits, and revocation, not just authentication.
Editorial analysis by NHI Mgmt Group, based on content published by Keyfactor: “Keyfactor Research Reveals Two-Thirds of Companies Say AI Agents Are a Bigger Security Risk Than Humans”.
By the numbers:
- 86% of cybersecurity professionals say AI agents and autonomous systems cannot be fully trusted without unique, dynamic digital identities.
- 69% of cybersecurity professionals believe vulnerabilities in AI agents and autonomous systems pose a greater threat than human misuse of AI.
- 85% of cybersecurity professionals expect digital identities for AI agents will be as common as human and machine identities within five years.
Key questions
Q: Why do autonomous AI systems increase security risk compared with human misuse?
A: Autonomous systems can initiate actions, repeat them quickly, and interact with other systems without waiting for a human decision at each step.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Q: What breaks when digital IDs are missing for AI agents?
A: Without a durable identity for each agent, organisations lose the ability to track permissions, correlate actions to a specific actor, and retire access cleanly.
Practitioner guidance
- Define unique agent identities Assign every AI agent a distinct identity, lifecycle owner, and revocation path so behaviour can be attributed to a specific actor rather than a shared workload label.
- Bind actions to cryptographic provenance Record which agent, session, and code path produced each significant action so investigation, approval, and rollback can rely on evidence rather than inference.
- Set enforceable runtime boundaries Constrain tool access, data reach, and delegation depth so an agent cannot expand its scope beyond the authorisation context in which it was issued.
Bottom line: AI agents change the identity problem because they can act autonomously, not just authenticate like ordinary software.
Glossary terms: Reusable Digital Identity, Agentic AI Identity, Cryptographic Provenance, Recognition-action gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:58 am
Dynamic identity is now a prerequisite for agent trust: An AI agent that can initiate actions, select tools, and interact with other agents cannot be governed by identity assumptions designed for passive software. The field has moved from authenticating a requester to governing an actor that can change state mid-session. The practitioner implication is that identity has to describe runtime behaviour, not just static entitlement.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: How should security teams govern scheduled AI agents across IAM, PAM, and NHI programmes?
A: Treat each routine as an identity with an owner, a narrow scope, an expiry path, and an approval boundary for any irreversible action. Then apply the same lifecycle discipline you would use for other non-human identities: inventory, scoping, review, and offboarding. If it can run unattended, it needs unattended governance.
👉 Read our full editorial: Survey shows AI agent identity controls are lagging enterprise trust
This post was modified 1 day ago by NHI Mgmt Group