Topic starter
22/06/2026 1:42 pm
TL;DR: AI is reshaping cybersecurity operations, but the bigger governance problem is shadow AI, agentic identity, and the need for human oversight as budgets stay flat, according to SPHERE Technology Solutions and Ed Amoroso. Identity programmes now have to track ownership, provenance, and continuous access decisions across people, machines, and AI agents.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Shadow AI, Budgets, and the Future of Identity Security”.
Key questions
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Q: Why do AI agents require stronger identity controls than standard applications?
A: AI agents can choose actions, call tools, and chain operations, so their identity is not just a login mechanism.
Q: How do organisations keep human oversight meaningful in AI workflows?
A: Human oversight stays meaningful only when humans have enough context, time, and authority to intervene.
Practitioner guidance
- Map AI-enabled access paths Inventory every application, workflow, and platform feature that can call models, agents, or automated decision services, then assign an owner and a control boundary for each one.
- Classify agentic identities separately Create a separate identity class for autonomous agents so provenance, tool use, and delegated authority are governed distinctly from standard service accounts.
- Require lineage logging for AI actions Capture which agent or AI feature initiated an action, which tools it invoked, what data it touched, and whether a human approved the outcome.
Bottom line: Shadow AI creates governance gaps because organisations often cannot see or own the AI-enabled access paths already operating inside business tools.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:47 pm
Shadow AI is an identity governance problem before it is an AI problem. When organisations cannot inventory AI features, they cannot govern their access paths, ownership, or review cycles. That breaks the basic IGA assumption that every active identity-like thing is known, named, and assigned. The implication is that AI discovery becomes a prerequisite for identity control, not an adjacent security task.
A few things that frame the scale:
- Companies are dedicating an average of 32.4% of their security budgets to secrets management and code security, with US organisations leading at 40.8%, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between human IAM and agentic AI governance?
A: Human IAM is built around users, sessions, and relatively predictable access patterns. Agentic AI governance must also control memory, delegation, and machine-speed actions that can continue after the original request is made. That means identity policy has to follow the task lifecycle, not just the login event, and must cover both authorization and state handling.
👉 Read our full editorial: AI in cybersecurity is exposing shadow AI governance gaps