Topic starter
11/07/2026 8:27 pm
TL;DR: Forrester Summit coverage says security leaders are balancing enterprise, ecosystem, and external risk while AI agents rapidly reshape operations, with 32% of respondents seeing critical risk events rise year-over-year and 41% naming cyberattacks the top risk event, according to Elisity. The real issue is that governance, identity, and Zero Trust controls still assume slower, human-paced decision cycles that agentic systems do not follow.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “Day 1 at Forrester Security & Risk Summit 2025: AI Agents, Zero Trust, and What's Coming”.
By the numbers:
- 32% of respondents said discrete critical risk events are increasing year over year.
- 41% identified cyberattacks as the #1 risk event.
Key questions
Q: What breaks when AI agents are reviewed like human users?
A: Human review assumes access is stable long enough to be observed, approved, and recertified.
Q: Why do AI agents create risk in Zero Trust environments that were built around human behavior?
A: AI agents create risk because Zero Trust depends on observable patterns, and agents do not behave like people.
Q: What are the warning signs that AI governance is lagging behind agentic execution?
A: Common signs include unclear ownership of agent permissions, heavy reliance on periodic recertification, broad tool access that is not task-scoped, and policies that describe intent but do not enforce runtime boundaries.
Practitioner guidance
- Define least agency rules for agentic workflows Set explicit minimum authority, time limits, and task boundaries for each agentic workflow so permissions expire with the work, not after it.
- Map Zero Trust governance to decision ownership Build a governance matrix that separates strategic approval, operational ownership, and tactical enforcement for AI-driven access paths.
- Treat recertification as secondary for fast-moving agents Use recertification to validate policy intent, but do not rely on it as the primary safeguard when permissions may be consumed inside one task.
Bottom line: AI agents are forcing Zero Trust and IAM teams to confront a control gap between human-paced governance and runtime decision-making.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:57 pm
Zero Trust governance is being asked to solve a timing problem it was not originally shaped for. Human-paced controls assume that access can be granted, monitored, and reviewed in a stable window. Agentic systems compress that window, so governance has to move from periodic certification to runtime authority design. The practitioner implication is that control cadence now matters as much as control type.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams balance autonomy and accountability for AI agents?
A: Treat autonomy as a controlled delegation problem, not as a general permission to act. The safest model keeps human ownership explicit, separates operator responsibility from agent execution, and requires that every meaningful action be attributable to a specific policy decision. Without that separation, auditability degrades even when the system appears compliant on paper.
👉 Read our full editorial: AI agents and zero trust are colliding with old governance models