Topic starter
03/06/2026 11:02 am
TL;DR: Akeyless's research finds persistent credentials, weak visibility and fast-moving delegated access are already creating governance gaps for AI agent identity. Runtime enforcement and lifecycle revocation are the controls most likely to limit exposure when agents exceed intended scope.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “New Research Shows AI Agents Are Outpacing Identity Security”.
By the numbers:
- 94% of organisations report some level of AI agent use today.
- Organizations expect AI agent usage to increase another 44% over the next 12 months.
Key questions
Q: Why do long-lived credentials create a bigger risk for AI agents than for traditional automation?
A: AI agents can choose tools and sequence actions dynamically, so long-lived credentials become durable authority across many unpredictable requests.
Q: What are the signs that an AI identity is failing governance even if access looks limited?
A: An AI identity is failing governance when teams cannot name an owner, explain why it exists, or trace what it did.
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Practitioner guidance
- Map every AI agent credential path Inventory where AI agent credentials live, who owns them, what systems they reach, and whether they are tied to code, workflows, or secrets stores.
- Replace static access with short-lived issuance Reduce reliance on persistent API keys, static secrets, and long-lived OAuth grants by moving agent access toward ephemeral, task-scoped credentials.
- Enforce runtime policy at execution time Apply policy controls that can constrain agent behaviour while actions are occurring, rather than waiting for manual recertification or incident review.
Bottom line: AI agent identity security is shifting from account provisioning to control of delegated behaviour in motion.
Glossary terms: AI Agent Identity, Persistent Credential, Runtime Enforcement
What's in the full report
Akeyless's full analysis covers the operational detail this post intentionally leaves for the source:
- The full survey methodology behind the 400 IT and security leader responses
- The detailed breakdown of persistent credential types used for AI agents
- The specific operational metrics for detection time, containment time, and remediation cost
- The article's discussion of runtime identity security controls and deployment models
👉 Read Akeyless's analysis of AI agent identity security and IAM limits →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
03/06/2026 11:05 am
Human IAM assumptions are collapsing under agent behaviour: Traditional access governance was designed for identifiable human users, bounded sessions, and predictable review cycles. AI agents break that premise because they continue acting across systems after provisioning, often through delegated credentials that outlive the moment of approval. The implication is that identity governance must stop treating agent access as an extension of user access and start treating it as a distinct operational identity problem.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should security teams prioritise runtime enforcement or periodic review for agents?
A: Runtime enforcement should come first because periodic review cannot keep pace with agents that act continuously and at machine speed. Review still has value for governance reporting, but it cannot be the primary control when the access path can be used, chained, and abandoned within the same operational window.
👉 Read our full editorial: AI agent delegated access needs runtime control, not review cycles
This post was modified 7 days ago by NHI Mgmt Group