Notifications
Clear all
Topic starter
06/06/2026 11:34 am
TL;DR: C1’s 2026 Future of Identity Report found 95% of surveyed enterprises now run AI agents autonomously for IT or security tasks, while 80% experienced at least one identity-related breach and only 22% say they have full visibility into non-human identities, according to C1. The shift from human-paced approval to AI-speed delegation turns identity governance into a runtime control problem, not a periodic review exercise.
NHIMG editorial — based on content published by ConductorOne: Future of Identity Report finds enterprises rapidly operationalizing AI agents while governance gaps widen
By the numbers:
- 95% of organizations report AI agents performing IT or security tasks autonomously, compared to 96% that said they planned to operationalize agents just one year ago.
- 80% of organizations experienced at least one identity-related breach in the past year, with phishing and social engineering (52%) and malware or ransomware (46%) leading attack vectors.
- 91% of organizations increased IAM spending, signaling that identity security is becoming a foundational control as autonomous systems expand.
Questions worth separating out
Q: How should security teams govern AI agents that act autonomously in enterprise systems?
A: Treat autonomous agents as runtime identity subjects with explicit scope, expiration, and ownership.
Q: Why do autonomous AI agents create more identity risk than ordinary automation?
A: Ordinary automation follows a fixed script, while autonomous agents can choose actions and timing inside a session.
Q: What breaks when access reviews are used to govern AI agents?
A: Access reviews fail when they are asked to govern access that may only exist briefly or may change mid-session.
Practitioner guidance
- Inventory autonomous agents separately from generic automation Create a distinct classification for AI agents that perform operational work without human approval gates.
- Bind agent privileges to task scope and expiration Limit each agent to the smallest reachable set of systems needed for the task and make that access expire at task completion.
- Rework access reviews for machine-speed actions Use reviews to validate policy design, ownership, and exception handling rather than to chase actions that already completed.
What's in the full report
ConductorOne's full report covers the operational detail this post intentionally leaves for the source:
- Survey methodology and respondent breakdown across 508 U.S. enterprise IT and security leaders
- The full split between organisations that have operationalised agents, are piloting them, or are still early in rollout
- More detail on identity investment patterns, including how teams are prioritising IAM budgets across human and non-human estates
- The report's broader findings on agentic enterprise adoption and how practitioners are framing governance maturity
👉 Read ConductorOne's 2026 Future of Identity Report on autonomous AI agents →
AI agents and identity governance: what IAM teams need to know?
Explore further
06/06/2026 12:26 pm
Autonomous AI agents turn identity governance into a runtime control problem. Access reviews, certification cycles, and human approval workflows were designed for access that persists long enough to be observed and remediated. That assumption fails when an autonomous actor can select actions and execute them inside a single operational window. The implication is not simply more governance, but a redesign of the decision model that governs action as it happens.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of organisations say they can track and audit the data their AI agents access, leaving 48% with a compliance and investigation blind spot.
A question worth separating out:
Q: What does unified governance across human, non-human, and AI identities change for IAM teams?
A: It replaces separate control silos with one identity inventory, one ownership model, and differentiated policy depth by actor type. That helps teams see which identities are human, machine, or autonomous, and apply the right lifecycle, review, and approval model without leaving gaps between programmes.
👉 Read our full editorial: AI agents are outpacing identity governance in the enterprise
