Topic starter
15/08/2026 6:07 pm
TL;DR: Organisations now have roughly one AI agent for every 17 identities, alongside 54% of enterprise apps containing AI functionality and 490% year-over-year growth in AI-related attacks, according to Grip Security. The finding shows that identity governance is now being stretched by AI-enabled access patterns that traditional human-centric IAM cannot fully see or control.
Editorial analysis by NHI Mgmt Group, based on content published by Grip Security: “The Rule of 17: What AI Agent Growth Means for Security Teams”.
By the numbers:
- The Rule of 17 says organizations now have approximately one AI agent for every 17 identities.
- Grip Security says 54% of enterprise applications now contain AI functionality.
- Grip Security says the average user is exposed to 33.5 AI-enabled applications.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do AI agents increase risk in SaaS environments?
A: AI agents increase risk because they can operate through existing application permissions and continue using them as tasks change.
Q: What are the signs that an AI identity is failing governance even if access looks limited?
A: An AI identity is failing governance when teams cannot name an owner, explain why it exists, or trace what it did.
Practitioner guidance
- Discover AI agents across SaaS estates Inventory embedded AI features, autonomous workflows, copilots, and connected AI services so the non-human identity estate is visible before access review begins.
- Map delegated access relationships Trace which identities AI agents inherit, which OAuth grants exist, and which data sources those grants can reach across SaaS applications.
- Review AI permissions as non-human identities Apply identity governance to AI agents, service accounts, automation platforms, and machine identities rather than treating them as app settings.
Bottom line: AI agents are becoming a material part of the enterprise identity estate, and the governance model has to expand beyond human users to keep pace.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:16 pm
AI agent identity sprawl is the new baseline risk for SaaS governance: the control problem is no longer how many human users exist, but how many non-human actors now inherit access through the software stack. A Rule of 17 environment means agent discovery, entitlement mapping, and permission review must be treated as core identity work, not edge-case AI oversight. Practitioners should assume every embedded AI feature can expand the effective identity estate.
A question worth separating out:
Q: Should organisations treat AI agents at checkout as a separate identity pattern?
A: Yes. AI agents can place transactions at a speed and sequence that look unlike normal human checkout, which means legacy fraud controls may misclassify them. Teams should explicitly model authorised agents, capture session and permission context, and decide in advance how those patterns will be scored.
👉 Read our full editorial: The rule of 17 shows AI agent growth is outpacing IAM controls