Topic starter
06/06/2026 11:21 am
TL;DR: A 2025 survey of 260 executives found 91% of organisations already using AI agents in production, but only 10% have a strategy for managing them as identities, according to Aembit. The gap is not just operational; access review processes assume stable, reviewable privilege, while agents can act, delegate, and compound risk at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “AI Agent Identity Security: Why It Matters and How to Get It Right”.
By the numbers:
- 91% of organizations are already using AI agents in production, according to Aembit.
- Only 10% have a strategy for managing those agents as identities, according to Aembit.
Key questions
Q: What breaks when AI agents are managed like ordinary machine identities?
A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review.
Q: Why do AI agents increase identity risk even when the login succeeds?
A: A successful login only proves that the agent reached the system.
Q: How do you know if agent identity controls are actually working?
A: Look for whether you can reconstruct a complete path from trigger to identity to permission to action.
Practitioner guidance
- Inventory every AI agent in scope Discover agents embedded in SaaS tools, orchestration frameworks and developer workflows, then record what each one can reach, which credentials it uses and who owns it.
- Replace static credentials with task-scoped access Move high-risk agents to just-in-time, short-lived credentials so a compromise cannot reuse a persistent token across unrelated systems.
- Make delegation chains auditable Capture each handoff from user to agent to subagent, including the resource, purpose and scope attached to the delegated action.
Bottom line: AI agents change identity governance because they act after authentication, not just during login, and that runtime behaviour falls outside legacy IAM assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 23 hours ago by NHI Mgmt Group
06/06/2026 12:07 pm
AI agent identity security is now a distinct governance discipline, not a variant of workload IAM. AI agents decide at runtime, can delegate, and can compound actions across tools and services, which means the control problem is behavioural rather than purely credential-based. That shifts the governance question from whether an identity can log in to whether its runtime authority is bounded, auditable and revocable. Practitioners should treat agent identity as its own lifecycle with its own accountability model.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise just-in-time access or static secret rotation for AI agents?
A: Just-in-time access should come first because the core problem is not only secret age, but the mismatch between dynamic agent behaviour and persistent authority. Static rotation helps, but it still leaves a reusable secret model in place. Ephemeral access reduces the window in which agent misuse can compound.
👉 Read our full editorial: AI agent identity security is outpacing traditional IAM controls
This post was modified 23 hours ago by NHI Mgmt Group