Topic starter
16/12/2025 5:33 pm
TL;DR: AI agents are already in production at 91% of organizations, yet only 10% have a strategy for managing them as identities, creating a gap where authenticated actions can still go rogue, according to Aembit’s cited survey and incident analysis. Static IAM models cannot validate agent intent after login, so runtime controls become the decisive layer.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “AI Agent Identity Security: Why It Matters and How to Get It Right”.
By the numbers:
- 91% of organisations are already using AI agents in production, according to Aembit.
- Only 10% have a strategy for managing those agents as identities, according to Aembit.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do valid credentials still fail to protect against AI agent mistakes?
A: Because a valid credential only proves the system recognised the identity.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Practitioner guidance
- Inventory every live AI agent Build a complete register of agents embedded in SaaS tools, development workflows, and orchestration frameworks.
- Replace standing credentials with ephemeral scope Move the highest-risk agents first to short-lived credentials that expire after each task or request.
- Make delegation chains auditable Capture who delegated authority, which agent received it, which subagents inherited it, and what resources each hop touched.
Bottom line: AI agents create an identity gap because successful authentication does not control what they do next, and that is where the real security failure appears.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
06/10/2026 9:23 pm
AI agent identity security is a runtime governance problem, not a login problem. Once a valid credential is issued, traditional IAM often assumes the remaining action path is still safe. AI agents invalidate that assumption because they select tools and actions at runtime, which means the decisive control point shifts to the moment of execution. The practitioner implication is that post-authentication policy must become a first-class identity control.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when AI tools can take actions on behalf of users?
A: Treat agent actions as governed identity events and require logging of tool calls, delegation chains, and execution context. Without that layer, investigations cannot tell whether an action came from the human operator, the agent, or a downstream delegated workflow.
👉 Read our full editorial: AI agent identity security needs runtime controls, not just login checks