Topic starter
23/06/2026 9:06 pm
TL;DR: Enterprise AI agents are already operating at scale, often without review or governance, with Fortune 50 environments showing more than 150,000 agent-tied resources and 82% of those agents built by non-professional developers, according to Zenity. The real issue is not future adoption but unmanaged runtime identity sprawl that makes visibility the prerequisite for control.
Editorial analysis by NHI Mgmt Group, based on content published by Zenity: “Your AI Agent Inventory Is Incomplete. Here's What That Means for Risk.”.
By the numbers:
- Fortune 50 organizations have discovered attack surfaces containing more than 150,000 total resources tied to agents and automations.
- Fortune 50 pharmaceutical organizations have found over 2,000 instances of agents shared across their entire organizational footprint.
- 82% built by people who aren't professional developers.
Key questions
Q: What breaks when an AI agent is deployed without formal ownership?
A: When an AI agent has no formal owner, review, offboarding, and incident response all become slower and less reliable.
Q: Why are shadow AI agents a risk for enterprises?
A: Shadow AI agents operate without formal governance or oversight, posing risks of unauthorized access and data breaches.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Build a living AI agent inventory Track every known agent, its creator, owner, credentials, connected systems, and current approval status so the estate can be governed as a principal set rather than as ad hoc automations.
- Assign a named owner to each agent Make business ownership mandatory for every discovered agent, including those embedded by SaaS vendors or created through low-code platforms, so review and offboarding have an accountable endpoint.
- Classify agent permissions by blast radius Document which systems each agent can reach, which workflows it can trigger, and which credentials it can reuse, then flag agents whose access crosses sensitive business domains.
Bottom line: AI agents are already creating identity governance gaps because many enter the enterprise outside IT review and without durable ownership.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 2:14 am
AI agent inventory is now a prerequisite control, not an administrative nice-to-have. The article correctly reframes agent sprawl as an identity governance problem rather than a tooling curiosity. Once agents can be created outside central review and persist through SaaS defaults or low-code workflows, every downstream control depends on first knowing the agent exists. The practitioner conclusion is simple: inventory is the control that makes every other control possible.
A few things that frame the scale:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
👉 Read our full editorial: AI agent inventory gaps are widening enterprise risk in 2026