Topic starter
17/08/2026 4:38 pm
TL;DR: C1.ai’s 2025 Future of Identity Security report finds that 89% of security leaders plan to use AI agents within two years, while 83% are concerned about the risks and 96% expect deployments to extend beyond non-critical tasks. The gap is not enthusiasm versus caution, but governance that has not yet caught up with agentic access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “Survey: Security Leaders Go All in on AI Agents to Address Surging Identity Attacks”.
By the numbers:
- 89% of respondents plan to use AI agents in their security departments within the next two years.
- 83% of respondents say they are concerned about the risks posed by agentic AI.
- 96% of respondents say their planned agentic AI deployments will not be limited to non-critical tasks.
Key questions
Q: What breaks when AI agent governance is treated as access control?
A: The control boundary breaks first.
Q: Why do AI agents increase non-human identity risk?
A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission.
Q: How do security teams know if an AI agent has too much access?
A: Look for agents that can reach multiple systems without task-specific limits, use persistent tokens, or touch high-value services such as email, chat, cloud consoles, and file stores.
Practitioner guidance
- Define agent-specific access boundaries Treat AI agents as governed identities with explicit task scope, target systems, and revocation conditions instead of broad operational access.
- Separate low-risk experiments from operational workflows Limit early AI agent use to tightly bounded scenarios while keeping access requests, provisioning, and monitoring under human-controlled policy.
- Map agent permissions to business tasks Tie each agent permission set to a named workflow so access can be reviewed against a concrete purpose rather than an assumed role.
Bottom line: AI agents are moving into security workflows faster than most identity governance models are adapting, which creates a control gap around delegated access and accountability.
What's in the full report
C1.ai's full survey post covers the operational detail this post intentionally leaves for the source:
- The full survey breakdown of AI agent adoption plans across security teams and leadership pressure points
- Methodology details from a survey of 494 U.S.-based IT security leaders at companies with 500 or more employees
- The article's full breakdown of identity attack pressure, NHI urgency, and the top AI security use cases
- The vendor's complete summary of how respondents are balancing AI adoption with identity risk and IAM budget growth
👉 Read C1.ai's survey on AI agents and identity risk in security teams →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:44 pm
Agentic identity governance is now a present-tense control problem, not a future architecture question. The survey shows adoption intent rising even while risk concerns remain high, which means organisations are making identity decisions under operational pressure. That combination typically produces delegated access before delegated accountability, especially where security teams want AI to absorb high-friction work. The practitioner implication is that agentic access policies need to be designed before deployment scales.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise AI agent use in security operations or identity cleanup first?
A: Identity cleanup should come first when the environment already has over-privilege, unclear ownership, or fragmented access records. AI agents will amplify whatever governance model they inherit, so scaling them before reducing entitlement noise usually increases operational speed without improving control.
👉 Read our full editorial: Security leaders are fast-tracking AI agents despite rising identity risk