Top Security Questions for CISOs on AI Agent Adoption Risks

TL;DR: AI agent adoption has outpaced the architectures built to govern it, with more than 3 million agents operating globally and thousands added weekly, according to Okta research drawing on Software Analyst Cyber Research and Stanford Graduate School of Business. Static IAM is no longer enough when agents discover tools, move across systems, and act at runtime.

Editorial analysis by NHI Mgmt Group, based on content published by Okta: “CISO's Guide: Essential AI Agent Security Questions”.

By the numbers:

• Enterprises now run roughly 144 non-human identities for every human user.

Key questions

Q: What breaks when AI agents are managed like ordinary machine identities?

A: What breaks is the assumption that access scope can be fully understood from provisioning data and quarterly review.

Q: Why do service accounts and AI agents increase lateral movement risk?

A: Service accounts and AI agents often operate with persistent permissions across multiple systems, which makes them useful stepping stones after compromise.

Q: How do security teams know if agent governance is actually working?

A: It is working only if the team can answer three questions quickly for any agent: what it can reach, what it did recently, and whether that behaviour matches intent.

Practitioner guidance

• Build continuous agent discovery Aggregate signals from browsers, endpoints, SaaS platforms, gateways, and MCP layers so new agents are registered as soon as they appear, including shadow and ephemeral instances.
• Map agent connection paths Document every API, database, SaaS application, and MCP server an agent can reach, then remove unnecessary reach before expanding deployment.
• Enforce runtime authorization Apply context-aware checks at execution time for sensitive actions, not only at initial provisioning, so intent and sequence are evaluated when the agent acts.

Bottom line: AI agents break the assumption that identity governance can be handled at provisioning time, because their access and behaviour change while they are working.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →