Topic starter
06/06/2026 11:34 am
TL;DR: C1.ai’s 2026 Future of Identity Report finds 95% of surveyed enterprises now run AI agents autonomously for IT or security tasks, while 80% experienced an identity-related breach and only 22% say they have full visibility into non-human identities. Identity governance is being forced from periodic review into runtime control.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1 Survey Finds 95% of Enterprises Now Run AI Agents Autonomously as Identity Risks Escalate”.
By the numbers:
- 95% of organizations report AI agents performing IT or security tasks autonomously.
- 80% of organizations experienced at least one identity-related breach in the past year.
- Only 22% say they have full visibility into those identities.
Key questions
Q: What breaks when AI agents are reviewed like human users?
A: Human review assumes access is stable long enough to be observed, approved, and recertified.
Q: Why do unknown AI agents create a higher identity risk than approved ones?
A: Unknown agents bypass the normal lifecycle steps that make access governable, including approval, recertification, and offboarding.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Define agent-specific authorisation boundaries Map each AI agent to the exact tools, data sources, and operations it may use, then remove everything outside that task scope from standing access.
- Create a unified identity inventory Inventory service accounts, API keys, automation workflows, and AI agents in one control view so ownership and access scope can be traced end to end.
- Shift reviews toward runtime controls Use issuance-time policy, task-scoped access, and telemetry on agent actions so governance does not depend on periodic recertification alone.
Bottom line: AI agents are now embedded in enterprise operations at a scale that makes identity governance a live operational issue rather than a future planning exercise.
What's in the full report
C1.ai's full report covers the operational detail this post intentionally leaves for the source:
- Survey methodology for 508 IT and security leaders at U.S. organisations with more than 1,000 employees
- Breakdown of agentic enterprise adoption across production, pilot, and early workflow stages
- The full set of identity-related breach vectors, including phishing, social engineering, malware, and ransomware
- Organisational responses to NHI risk, including IAM spending and governance priorities
👉 Read C1.ai’s report on AI agents, identity risk, and the agentic enterprise →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 12:26 pm
Autonomous identity governance is collapsing the assumption that access persists long enough to be reviewed. Human-paced certification cycles were built for stable entitlements and predictable operators. Autonomous agents can obtain and use privileges inside a short execution window, so the control now fails at the timing layer as much as at the permission layer. Practitioners need to treat issuance-time control as the governing boundary.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Treat the agent as an identity surface, but treat the service account as the source of effective privilege. The agent itself usually acts through delegated access, so governance should trace the full chain from invoker to agent to service account to downstream resources. That approach exposes blast radius, shared credentials, and over-privileged paths before they turn into control gaps.
👉 Read our full editorial: AI agents are outpacing identity governance in the enterprise