Topic starter
06/06/2026 1:40 am
TL;DR: A global study of 1,100 organisations found that 93% already use or plan to use AI agents for sensitive security tasks, while only 65% say those identities are fully registered and 32% are very confident they could regain control after credential exposure, according to Semperis. The governance gap is no longer theoretical: AI identities are being admitted into critical systems before the control plane is ready.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “New Semperis Study Reveals AI’s Effects on the Identity Attack Surface”.
By the numbers:
- The study surveyed 1,100 organisations across the U.S., U.K., France, Germany, Italy, Spain, Australia and Singapore.
- 93% already use or plan to use AI agents for sensitive security tasks such as password resets and VPN access.
- Only 32% are very confident they could regain control if AI exposes admin credentials.
Key questions
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
Q: Why do AI agents stress identity infrastructure more than normal automation?
A: Because they can create continuous, machine-paced access demand that exceeds the assumptions built into most IAM systems.
Q: How do organisations know if AI identity governance is working?
A: They should be able to answer three questions quickly: which agents exist, which credentials each one uses, and who is accountable for each identity’s lifecycle.
Practitioner guidance
- Classify AI agents as governed non-human identities Put every agent that touches identity infrastructure into the same inventory and ownership model you use for other high-value NHI credentials.
- Restrict agent access to just-enough identity functions Scope agent permissions to the smallest feasible set of identity tasks, especially password resets, VPN access and administrative workflows.
- Separate agent trust boundaries from human trust boundaries Do not let human and agent authentication paths blend by default.
Bottom line: AI agents are widening the identity attack surface because they can be placed inside critical workflows before the surrounding governance model is complete.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 2:56 am
AI agents are now part of the identity attack surface, not just consumers of it. When an agent can request resets, touch VPN access or sit near privileged secrets, the identity layer itself becomes the security boundary. That shifts governance from application-centric oversight to direct control of machine identities embedded in core IAM systems. Practitioners should stop treating agent access as temporary tooling and start treating it as a governed identity class.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: Should organisations treat autonomous agents like human users or service accounts?
A: Organisations should not treat autonomous agents as simple human analogues. They behave like governed non-human identities with added runtime decision-making, so they need identity boundaries, action checkpoints, and clear accountability. Human-style certification cycles alone are too slow for systems that can complete sensitive work within one session.
👉 Read our full editorial: AI agents are widening identity attack surfaces faster than safeguards