Topic starter
03/06/2026 11:02 am
TL;DR: Akeyless reports that 94% of organisations already use AI agents, 85% say those agents can access sensitive data, and more than two-thirds suspect agents have gone beyond intended scope, showing that IAM built for human sessions and static workloads no longer fits agent behaviour. Access review cycles assume access stays stable long enough to inspect, but AI agents can acquire and use delegated privileges continuously at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “New Research Shows AI Agents Are Outpacing Identity Security”.
By the numbers:
- 94% of organisations report some level of AI agent use today.
- Organizations expect AI agent usage to increase another 44% over the next 12 months.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do long-lived credentials create a bigger risk for AI agents than for traditional automation?
A: AI agents can choose tools and sequence actions dynamically, so long-lived credentials become durable authority across many unpredictable requests.
Q: What are the signs that an AI identity is failing governance even if access looks limited?
A: An AI identity is failing governance when teams cannot name an owner, explain why it exists, or trace what it did.
Practitioner guidance
- Map every AI agent credential path Inventory where AI agent credentials live, who owns them, what systems they reach, and whether they are tied to code, workflows, or secrets stores.
- Replace static access with short-lived issuance Reduce reliance on persistent API keys, static secrets, and long-lived OAuth grants by moving agent access toward ephemeral, task-scoped credentials.
- Enforce runtime policy at execution time Apply policy controls that can constrain agent behaviour while actions are occurring, rather than waiting for manual recertification or incident review.
Bottom line: AI agent identity security is shifting from account provisioning to control of delegated behaviour in motion.
What's in the full report
Akeyless's full analysis covers the operational detail this post intentionally leaves for the source:
- The full survey methodology behind the 400 IT and security leader responses
- The detailed breakdown of persistent credential types used for AI agents
- The specific operational metrics for detection time, containment time, and remediation cost
- The article's discussion of runtime identity security controls and deployment models
👉 Read Akeyless's analysis of AI agent identity security and IAM limits →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 11:05 am
Human IAM assumptions are collapsing under agent behaviour: Traditional access governance was designed for identifiable human users, bounded sessions, and predictable review cycles. AI agents break that premise because they continue acting across systems after provisioning, often through delegated credentials that outlive the moment of approval. The implication is that identity governance must stop treating agent access as an extension of user access and start treating it as a distinct operational identity problem.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams prioritise runtime enforcement or periodic review for agents?
A: Runtime enforcement should come first because periodic review cannot keep pace with agents that act continuously and at machine speed. Review still has value for governance reporting, but it cannot be the primary control when the access path can be used, chained, and abandoned within the same operational window.
👉 Read our full editorial: AI agent identity security is outgrowing human IAM controls