Topic starter
30/07/2026 10:51 pm
TL;DR: AI agents are entering production faster than governance frameworks can mature, and Soffid cites Keyfactor data showing half of organizations still lack AI agent governance while only 28% can stop an out-of-control agent before damage occurs. That gap makes identity, access, and detection convergence the real control problem, not another layer of tooling.
Editorial analysis by NHI Mgmt Group, based on content published by Soffid: “AI Agent Security: How to Govern the Next Wave of Non-Human Identities”.
By the numbers:
- Only 28% of organisations say they could stop the actions of an out-of-control AI agent before it causes damage.
Key questions
Q: What should teams do first when AI agents are already in production?
A: Teams should first inventory all agent identities, map the credentials they use, and verify that each one has a named sponsor and monitored workflow.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Classify AI agents as governed non-human identities Assign ownership, inventory, and lifecycle responsibility for each agent so it sits inside IAM and IGA processes rather than in an ad hoc operations bucket.
- Constrain agent permissions to task-scoped access Avoid broad standing access for agents that interact with confidential data, critical systems or external tools.
- Require request-level authentication and approval logic Design policy so each sensitive agent action is checked in context, rather than assuming a trusted session can execute multiple unrelated operations.
Bottom line: AI agents create a governance problem because they can chain actions across systems faster than traditional identity controls were designed to observe.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:58 pm
AI agent security is now an identity governance problem, not just an AI risk problem. The article correctly places AI agents inside the NHI governance model because they require ownership, traceability and lifecycle control. That matters because the failure mode is not only malicious compromise, but unmanaged authorised behaviour that exceeds its intended context. Practitioners should treat AI agents as governed identities with explicit accountability.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when AI agent autonomy and secure by design conflict?
A: They should treat autonomy as a governance constraint, not just a product feature. The practical test is whether the organisation can explain, monitor, and challenge the agent's decisions without relying on assumptions that only work for fixed workflows. If it cannot, the programme needs a stronger control model before wider deployment.
👉 Read our full editorial: AI agent security demands converged IAM, governance, and detection