Topic starter
02/08/2026 11:47 am
TL;DR: A market now splits between governance-first visibility and active testing plus runtime enforcement, while highlighting gaps in SaaS-centric coverage, MCP security, and red teaming, according to Akto. The core issue is that AI agent identity, permissions, and tool use require controls built for runtime behaviour, not just posture review.
Editorial analysis by NHI Mgmt Group, based on content published by Akto: “Zenity Security: Features, Architecture, Limitations & Akto Comparison”.
Key questions
Q: What breaks when agent security stops at discovery and posture review?
A: Discovery and posture review can show that an agent exists and appears compliant, but they do not prove the agent behaves safely under real conditions.
Q: Why do AI agent security gaps become operational risk at runtime?
A: Runtime is where delegated access becomes real impact.
Q: What are the signs that an AI agent security programme is too SaaS-centric?
A: A SaaS-centric programme usually misses homegrown frameworks, endpoint agents and MCP servers.
Practitioner guidance
- Map the full agent execution surface Inventory SaaS-managed agents, homegrown frameworks, endpoint-based agents and MCP servers together so governance scope matches where agent decisions actually happen.
- Separate posture review from runtime validation Require controls that evaluate permissions before launch and controls that observe tool calls, memory access and control flow during execution.
- Test the agentic attack path, not just the configuration Use adversarial probes for prompt injection, tool misuse, context leakage and permission escalation so you can see how the agent behaves under pressure.
Bottom line: AI agent governance fails when discovery and posture review are not matched by runtime enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:57 pm
AI agent governance is no longer a visibility problem alone. The article shows that discovery, monitoring and posture review each solve only one slice of the problem. NHI and agentic controls now have to account for runtime intent, not just declared permissions. The practical implication is that governance programmes must stop equating inventory with assurance.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern AI agents that use MCP?
A: Treat each connected agent as a non-human identity with an owner, a scope, and a review cycle. The practical control set is familiar: least privilege, secret rotation, access expiration, and auditability across the systems the agent can reach.
👉 Read our full editorial: AI agent governance still breaks at discovery, runtime, and scope