Topic starter
02/06/2026 12:59 pm
TL;DR: 87% of organisations say their identity security posture is ready for AI, yet 46% admit AI identity governance is deficient and 53% regularly encounter unauthorized AI tools or agents accessing systems, according to Delinea reports. The real failure is that legacy IAM still assumes human-paced review, while NHIs and AI agents now operate with standing access, weak ownership, and insufficient real-time visibility.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “The hidden risk of non-human identities in AI adoption”.
By the numbers:
- 87% of organisations say their identity security posture is prepared for AI.
- 46% of those surveyed admit that their AI identity governance is deficient.
- 53% of surveyed organisations regularly encounter unauthorized AI tools and agents accessing company systems.
Key questions
Q: What breaks when an AI agent is not part of identity inventory?
A: When an AI agent is not part of identity inventory, governance breaks at the point of discovery.
Q: When should organisations prioritise posture management for NHIs and AI agents?
A: Prioritise it before large-scale deployment, not after incidents or budget reviews.
Q: What are the signs that NHI governance is failing in agentic AI environments?
A: NHI governance is failing when security teams cannot answer basic questions about ownership, approval, and shutdown.
Practitioner guidance
- Establish a runtime inventory for NHIs and AI agents Map every machine identity, workflow account, and AI agent to a live access record that shows current permissions, owning team, and last observed activity.
- Classify standing access as an exception Require a documented operational reason for every NHI or agent with persistent privilege, then separate true uptime dependency from inherited convenience.
- Add ownership to every non-human identity Block any NHI or AI agent that lacks a named business owner, because unowned access cannot be certified, reviewed, or removed with confidence.
Bottom line: AI adoption is exposing a mismatch between declared readiness and real identity control, especially where NHIs and AI agents hold persistent access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/06/2026 1:00 pm
The real problem is not AI readiness, but identity governance drift. Organisations are reporting confidence in AI adoption while still admitting that AI identity governance is weak, which shows that readiness claims are outpacing control reality. That gap matters because machine and agent access does not fail like human access, so the old assurance model gives a false sense of coverage. The practitioner conclusion is that AI programmes need identity assurance tied to runtime behaviour, not survey sentiment.
A few things that frame the scale:
- 7% of security leaders admit they do not know how often their AI systems are making autonomous changes to infrastructure, according to the 2026 Infrastructure Identity Survey.
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise zero standing privilege or broader agent observability first?
A: Prioritise zero standing privilege first when agents can reach sensitive data or execute operational actions. Observability is necessary, but it does not reduce exposure on its own. If access remains persistent, the organisation still carries residual risk even when the activity is well logged.
👉 Read our full editorial: AI identity risk is exposing the NHI visibility gap in enterprise IAM