Topic starter
09/07/2026 1:39 pm
TL;DR: Ungoverned AI agents are already creating measurable cost through secrets management drag, audit overruns, and standing credential exposure, according to Opnova's analysis, which also cites developer time loss, exploitable stale credentials, and multi-million-dollar compliance burdens. The real issue is that existing joiner-mover-leaver and certification processes were built for stable identities, not rapidly multiplying agents that inherit human credentials.
Editorial analysis by NHI Mgmt Group, based on content published by Opnova: “The Business Case for Governing AI Agents”.
By the numbers:
- KPMG's 2025 SOX survey put the average program at $2.3 million and more than 15,000 person-hours a year, according to Opnova.
- McKinsey's 2025 State of AI survey found 62% of organisations are experimenting with AI agents but only 23% have scaled one into even a single business function, according to Opnova.
Key questions
Q: How do security teams detect AI agent sprawl before it becomes a breach issue?
A: Look for identity-layer signals rather than only approved application lists.
Q: Why do AI agents increase audit risk even when no breach has occurred?
A: AI agents increase audit risk because they expand the number of identities, credentials, and approvals that must be explained to auditors.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Inventory every agent identity Create a current count of deployed agents, the applications they touch and the credentials each one uses.
- Separate agent credentials from human credentials Stop letting agents borrow employee access where possible and assign each agent its own identity, ownership record and revocation path.
- Classify standing access as audit exposure Flag any agent credential that has no documented owner, no rotation schedule or no clear expiry as an audit finding waiting to happen.
Bottom line: AI agent sprawl is already consuming operational capacity through secrets handling, access review work and unresolved ownership, which makes it a current governance expense rather than an abstract future risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 1:43 pm
AI agent sprawl is already a governance cost, not a future risk: Organisations are paying for it today in engineering hours, certification effort and unresolved credential debt. The article is right to shift the conversation away from speculative harm and toward measurable operational drag. For identity leaders, that means AI agent governance must be funded as part of the identity programme, not parked as a future AI exception.
A few things that frame the scale:
- A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organizations approach the governance of AI agents?
A: Organizations should adopt a governance framework that incorporates continuous visibility, adaptive IAM practices, and stringent policy-based controls. This ensures that all agent actions are tracked, authorized appropriately, and assessed for compliance.
👉 Read our full editorial: AI agent sprawl is already a governance cost, not a future risk