Topic starter
11/08/2026 3:16 pm
TL;DR: The median enterprise now has 3.6 working AI agents for every technical employee, 84% of measured environments have agents outnumbering staff, and agent populations are growing 29% a month across live environments, according to Clutch Security research. That shifts identity governance from user provisioning to runtime control of agent-held credentials and production access.
Editorial analysis by NHI Mgmt Group, based on content published by Clutch Security: “One Laptop, Four Agents, 88 Credentials”.
By the numbers:
- In 84% of the environments measured, AI agents outnumber the technical staff they work alongside.
- Agent populations are growing 29% a month, doubling roughly every ten weeks.
Key questions
Q: What breaks when AI agents keep standing credentials?
A: The access model breaks because the agent can continue acting after the human has moved on, the workflow has shifted, or the original approval is no longer relevant.
Q: Why do AI agents create a larger blast radius than traditional automation?
A: AI agents can chain tools, reuse context, and expand their effective reach during execution, which means one over-permissioned identity can affect multiple systems quickly.
Q: How can security teams tell whether agent access is actually under control?
A: Look for evidence that the team can trace every tool call, secret use, and cross-system action back to a named owner and a valid approval path.
Practitioner guidance
- Build a live agent census Enumerate every working AI agent, the machine it runs on, and the credentials it can actually use.
- Classify agent access as privileged access Treat production-classified resources, cloud IAM roles, and secrets-bearing tokens used by agents as privileged paths.
- Move governance to the credential boundary Control the AWS profiles, GitHub tokens, database credentials, and SaaS secrets that agents inherit before they ever execute.
Bottom line: AI agents are already large enough in many environments to distort identity governance assumptions, especially where human lifecycle controls were the default design point.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
11/08/2026 3:29 pm
AI agent sprawl is now an identity governance problem, not a tooling curiosity. When the median enterprise has more agents than technical employees, the control question stops being whether agents are useful and becomes whether the identity model can even see them. Human-centred onboarding, review, and offboarding were never designed for software that arrives by install command and starts with inherited access. The practical conclusion is that agent identity must be governed as a first-class population, not folded into endpoint hygiene.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between governing the agent gateway and governing the underlying credentials?
A: The gateway governs one path, but the underlying credentials govern every path the agent can reach. If most tool use bypasses the gateway, then the real control plane is the credential itself, along with its scope, lifecycle, and offboarding. One is interface control, the other is identity control.
👉 Read our full editorial: AI agents are outnumbering technical staff and bypassing IAM
This post was modified 5 days ago by NHI Mgmt Group