Notifications
Clear all
Topic starter
24/06/2026 11:04 pm
TL;DR: Only 18% of security leaders are highly confident their IAM can manage agent identities, while 44% still rely on static API keys and 21% maintain a real-time inventory, highlighting a production governance gap, according to Strata Identity. Traditional IAM assumptions break when autonomous agents scale faster than ownership, inventory, and accountability structures can keep up.
NHIMG editorial — based on content published by Strata Identity: CSA survey report 2026 on securing autonomous AI agents starts with identity governance
By the numbers:
- Only 18% of security leaders are highly confident their IAM can effectively manage agent identities.
- 44% rely on static API keys for agent authentication, a legacy method unfit for autonomous systems.
- Only 21% maintain a real-time inventory of active AI agents in their environment.
Questions worth separating out
Q: What breaks when autonomous AI agents are managed like static service accounts?
A: Governance breaks at the point where the identity can choose actions at runtime.
Q: Why do autonomous agents complicate IAM and identity governance programmes?
A: They complicate IAM because the programme must govern both identity and behaviour.
Q: How do security teams know whether agent identity controls are actually working?
A: Look for three signals: every active agent has an owner, every agent action is traceable to a policy boundary, and high-risk actions require pre-execution review.
Practitioner guidance
- Map every active agent to a named business sponsor Create an authoritative register that ties each agent identity to an owner, purpose, environment, and approval path.
- Replace static API keys with scoped, revocable agent credentials Remove long-lived shared secrets from autonomous workflows and require credentials that are bound to workload context, least privilege, and explicit expiry.
- Build runtime checkpoints into agent execution paths Insert policy-defined approval points before high-risk actions such as external data access, tool chaining, or infrastructure change.
What's in the full report
Strata Identity's full report covers the operational detail this post intentionally leaves for the source:
- Question wording, survey methodology, and the full 285 plus respondent breakdown
- The environment-by-environment details behind agent authentication, inventory, and accountability practices
- The specific governance frictions reported across security, IT, and AI functions
- Additional survey findings that show how organisations expect agent adoption to scale over the next year
👉 Read Strata Identity's survey on securing autonomous AI agents →
Autonomous AI agent identity governance: are your controls keeping up?
Explore further
25/06/2026 7:51 am
Autonomous agent identity is now an IAM governance problem, not a niche AI concern. The survey shows that confidence, visibility, and authentication practices are already misaligned with the way agents actually behave at runtime. That is why this topic belongs in identity governance first, AI operations second, and security tooling third. Practitioners should treat agent identity as a core governance domain, not an experimental edge case.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, which shows that preparedness is lagging adoption.
A question worth separating out:
Q: Who should own autonomous AI agent governance in the enterprise?
A: Ownership should sit with a named business or technology sponsor, but enforcement must be shared across IAM, security, and the platform team that operates the agent. The key is not committee ownership but clear accountability for the agent's lifecycle, privileges, and approved use cases. Without that, responsibility fragments and no one can revoke or constrain the actor effectively.
👉 Read our full editorial: Autonomous AI agent identity governance is still failing in IAM
