Topic starter
27/06/2026 1:38 pm
TL;DR: AI agents are already performing around 30% of daily work at about 3x the rate leaders estimate, while fewer than 20% of companies have written AI policies and AI credential leakage rose 81% year over year to 1.27 million exposed secrets, according to Abnormal AI. Human-first IAM, DLP, and SIEM assumptions are collapsing as non-human actors increasingly behave like account takeovers.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “The Silent Storm of Shadow AI: Why Unsanctioned Agents Outpace Traditional Defenses”.
By the numbers:
- Employees use AI for about 30% of daily work at roughly 3x the rate leaders believe, according to Abnormal AI.
- AI credential leakage climbed 81% year over year to 1.27 million exposed secrets, according to Abnormal AI.
- Fewer than 20% of companies have written AI policies, according to Abnormal AI.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why does unmanaged AI tool adoption increase identity and data risk so quickly?
A: Every AI tool, embedded feature, or agent identity can become a new access path to sensitive data.
Q: What are the warning signs that shadow AI is becoming a security problem?
A: Look for AI tools connected outside approved procurement, unexplained API or token usage, and data leaving normal SaaS boundaries.
Practitioner guidance
- Classify AI actors as governed identities Create an explicit inventory of AI systems, agents, and shadow AI tools, and assign each one an owner, purpose, and approval path.
- Bind credentials to lifecycle ownership Track every AI credential, token, and API key back to a business owner and a revocation process so leaks do not become permanent access paths.
- Baseline behavioural scope for each AI identity Define expected actions, data boundaries, and tool usage for sanctioned AI actors, then alert on new paths, unusual timing, or expanded resource access.
Bottom line: AI agents and shadow AI are forcing IAM to treat non-human actors as governed identities rather than treating them as ordinary software.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
27/06/2026 3:02 pm
Human-first IAM is no longer a complete identity model. The article’s core claim is not simply that AI is changing workflows, but that enterprise controls still assume the actor is a person with predictable lifecycle events. That assumption fails when a non-human identity can execute work, call tools, and access data without fitting HR-centric governance. Practitioner takeaway: identity policy has to classify AI actors as governed subjects, not just applications.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- One in five organisations reported a breach due to shadow AI, and 97% of those breached through an AI model or application lacked proper AI access controls, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: AI agents are breaking human-first IAM assumptions in the enterprise
This post was modified 3 days ago by NHI Mgmt Group