Topic starter
10/12/2025 12:37 pm
TL;DR: Enterprises are moving into agentic AI while governance, lifecycle control, and privileged access practices are still maturing, according to CyberArk’s CIO perspective and cited market surveys. The security question is no longer whether AI agents will be adopted, but whether identity controls can keep pace with their autonomy.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “CIO POV: What am I actually supposed to do with agentic AI?”.
By the numbers:
- 50% of tech leaders have at least begun deploying agentic AI within their organizations, according to EY’s Technology Pulse Poll cited by CyberArk.
- CyberArk’s 2025 Identity Security Landscape finds that 68% of respondents lack identity security controls for AI.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Q: Why do agentic AI systems increase initial access and privilege abuse risk?
A: Because they can chain valid access into multiple tool calls without needing a human to approve each step.
Q: How do organisations know if agentic AI governance is actually working?
A: Look for three signals: access decisions tied to task context, complete audit records linking agents to datasets, and rapid revocation when scope changes.
Practitioner guidance
- Map AI agents to a distinct identity class Inventory every deployed agent, assistant, and autonomous workflow, then classify each by runtime decision authority, tool reach, and access scope.
- Constrain privileged access at issuance time Set explicit entitlement boundaries for each agent before deployment, including which systems it may call, which tools it may chain, and which data domains it may touch.
- Bind lifecycle controls to agent deployment events Tie provisioning, modification, pause, and retirement workflows to the agent lifecycle so permissions cannot persist after the use case ends.
Bottom line: Agentic AI changes the identity problem because the actor can make runtime decisions, not just consume preapproved access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 3 times by Abdelrahman
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 5:40 pm
Identity controls for agentic AI fail first at the assumption level. Traditional IAM and PAM were designed around access patterns where a human or fixed workload requests known privileges for a bounded purpose. That assumption fails when the actor can choose actions at runtime, combine tools dynamically, and alter its own execution path. The implication is that governance must stop treating autonomy as a cosmetic feature and start treating it as a different identity class.
A few things that frame the scale:
- 54% of organisations are actively deploying AI agents across workflows, yet only 21% report a mature governance model for agentic AI.
A question worth separating out:
Q: Should organisations prioritise AI agent lifecycle controls before wider AI adoption?
A: Yes. If organisations cannot provision, constrain, monitor, and retire agent identities reliably, broader adoption will outpace governance and widen exposure. Lifecycle control is the foundation that makes any later policy, review, or monitoring effort credible.
👉 Read our full editorial: Agentic AI governance is outpacing existing identity controls