Topic starter
16/04/2026 7:56 pm
TL;DR: 87% of 2,001 IT decision-makers believe their identity security is ready for AI-driven automation at scale, yet nearly half say governance for AI systems is deficient, exposing a gap between confidence and actual control, according to Delinea. The real risk is assuming human-centric identity controls can govern machine-speed AI agents and NHIs.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “The identity risk behind the AI security confidence paradox”.
By the numbers:
- 87% say their identity security is ready for AI-driven automation at scale.
- 2,001 IT decision-makers actively using or piloting AI were surveyed.
- 82% of respondents expressed strong confidence in their ability to discover NHIs with access to production systems.
Key questions
Q: What breaks when AI agents are given access without identity governance?
A: What breaks is accountability.
A: Over-privileged AI systems expand blast radius because they can move faster, touch more systems, and make repetitive mistakes at scale.
Q: How do organisations know if AI identity governance is working?
A: They should be able to answer three questions quickly: which agents exist, which credentials each one uses, and who is accountable for each identity’s lifecycle.
Practitioner guidance
- Map AI agents to explicit identity owners Create an inventory of every AI agent, the business unit using it, the systems it can reach, and the human owner accountable for changes in access scope.
- Validate access in real time Replace periodic review with continuous checks on AI and NHI inventory, usage, and access patterns, especially where production systems are involved.
- Convert standing access to ephemeral grants Use just-in-time issuance so AI privileges exist only for the task being executed and cannot accumulate between review cycles.
Bottom line: The article describes a confidence gap, not a tooling gap alone, and that gap appears when human-designed identity controls are applied to AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 2:39 am
AI security confidence has outgrown identity verification. The article shows a field-wide pattern where security leaders believe they are ready for AI-driven automation even though governance for AI systems is still incomplete. That gap matters because confidence without current validation is not a control, it is an assumption. Practitioners should treat readiness claims as unproven until inventory, usage, and access are continuously verified.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 88% of organisations have embedded AI agents in their workflows, according to KPMG's 2026 report.
A question worth separating out:
Q: When should organisations apply zero standing privilege to AI systems?
A: Organisations should apply zero standing privilege whenever an AI system can access sensitive data, trigger operational actions, or invoke external tools. If the system does not need persistent access, it should not have it. Ephemeral access reduces the damage from prompt injection, credential theft, and runaway automation.
👉 Read our full editorial: AI security confidence is outpacing identity governance for agents