Topic starter
18/02/2026 3:16 pm
TL;DR: AI security posture starts with discovery, but 92% of organisations lack full visibility into AI identities and 95% doubt they could detect misuse, according to Saviynt. Visibility, access timelines, and intent deviation analysis are now the baseline for governing AI agents before lifecycle and access control can work.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “You Can’t Secure what you Can’t See - Posture Management for AI Agents”.
By the numbers:
- 92% of organisations lack full visibility into AI identities.
- 95% doubt they could detect misuse if it happened.
Key questions
Q: What breaks when AI agent posture visibility is missing?
A: When posture visibility is missing, teams lose the ability to inventory agents, understand their effective privileges, and detect shadow AI acting outside approved boundaries.
Q: Why do AI agent runtimes create more governance risk than ordinary service accounts?
A: AI agent runtimes can combine decision-making, tool use, and secret access in one execution path, so a single trust failure can cause data exposure and operational change.
Q: How can security teams tell whether AI posture management is actually working?
A: It is working when teams can answer four questions quickly and consistently: who owns the agent, what it can access, which guardrails apply, and when access changed.
Practitioner guidance
- Inventory every AI identity source Correlate declared platforms, MCP servers, code pipelines, network signals, and IAM data to find agents that are not registered anywhere else.
- Map AI permissions to actions Record whether each agent can read, update, or trigger high-risk operations inside each system, not just which applications it can reach.
- Track access timelines for drift Preserve registration dates, entitlement changes, model-version changes, and query history so you can prove when scope expanded or should have been removed.
Bottom line: AI agent posture management begins with identity visibility because governance fails when organisations cannot reliably find the agents already operating in their environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 8:11 pm
AI agent posture management is now an identity visibility problem, not just a security feature request. The article’s central insight is that organisations cannot govern what they have not inventoried, and AI agents multiply that problem through shadow deployment, delegated access, and runtime change. That moves posture management ahead of lifecycle, audit, and access control in the control stack. Practitioners should treat discovery as the first governance boundary, not a preparatory task.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when an AI agent has no clear owner or business justification?
A: They should suspend or remove the agent until ownership, purpose, and access scope are documented. Orphaned agents are a governance failure, not a tolerated edge case, because they preserve access without accountability and often retain credentials long after the original experiment or deployment has ended.
👉 Read our full editorial: AI agent posture management is becoming an identity visibility problem