Topic starter
28/04/2026 5:31 pm
TL;DR: A CSA survey of 418 IT and security professionals found 82% had discovered at least one AI agent or autonomous workflow created outside security, IT, or governance awareness, while 65% of enterprises reported an AI agent incident in the past 12 months, according to Token Security's analysis. The control problem is not theoretical: discovery without lifecycle governance leaves autonomous identities accumulating risk faster than legacy IAM can absorb.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “Autonomous, But Not Controlled: The Illusion of AI Agent Governance”.
By the numbers:
- 82% of organisations had discovered at least one AI agent or autonomous workflow created without governance awareness.
- 65% of enterprises reported an AI agent incident in the past 12 months.
- Only 21% of organisations have any formal decommissioning process in place for AI agents.
Key questions
Q: What breaks when AI agents are discovered but not lifecycle-managed?
A: Discovery alone breaks down because the organisation still cannot tell who owns the agent, whether it is still needed, or when its access should end.
Q: Why do unmanaged AI agents create a larger risk than managed ones?
A: Unmanaged AI agents are harder to audit, revoke, and contain because no one can reliably answer who owns them, what they can reach, or whether they still need access.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define a governed AI agent inventory Record owner, purpose, environment, credentials, and current privilege scope for every agent so discovery turns into actionable governance.
- Create mandatory agent offboarding triggers Revoke credentials, API keys, OAuth grants, and service account bindings when the task, project, or owner relationship ends.
- Move from periodic review to continuous monitoring Track agent actions, permission changes, and anomalous API use continuously so scope drift is visible before business impact occurs.
Bottom line: AI agent governance breaks down when organisations can discover agents but cannot prove ownership, retirement, or current privilege scope.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 4:27 pm
AI agent governance fails because discovery without lifecycle ownership is not governance. The article shows that organisations can know agents exist and still not control them, because creation, approval, and offboarding are scattered across teams and tools. That is why visibility metrics can look healthy while risk continues to grow. The practitioner conclusion is blunt: inventory without accountable ownership is only a register, not a control.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI SOC agents like governed identities?
A: Yes, because the practical risk is delegated access, not just model output. If an AI agent can read evidence, prepare actions, or trigger connected tools, it needs scoped permissions, defined task boundaries, and revocation when the workflow ends. That is the identity control model SOC teams already use for other non-human actors.
👉 Read our full editorial: AI agent governance is failing where visibility and lifecycle control break down