Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: Gartner’s Hype Cycle for Artificial Intelligence, 2026 places AI Governance Technologies in a moderate-benefit, 5% to 20% penetration category and argues that policy written on paper breaks down once agents act autonomously, according to Lasso Security. The practical shift is from periodic audit controls to runtime enforcement, observability, and policy-by-design across the AI life cycle.
NHIMG editorial — based on content published by Lasso Security: Lasso Named in Gartner's Hype Cycle for Artificial Intelligence, 2026
By the numbers:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should security teams govern AI agents that inherit authority from other identities?
A: Security teams should govern AI agents by tracking identity lineage, not just credentials.
Q: Why do periodic GRC controls fail for agentic AI systems?
A: Periodic controls assume the risky action will still be visible when the review happens.
Q: What breaks when AI agents are not governed at runtime?
A: Without runtime governance, an agent can shift behaviour after provisioning and still execute actions that were never reviewed in context.
Practitioner guidance
- Define runtime policy enforcement points Map where AI actions can be blocked, approved, or logged before they affect downstream systems.
- Scope every AI agent to a dedicated identity Assign each agent a bounded identity, separate credentials, and task-specific permissions so access can be reviewed, rotated, and revoked without affecting unrelated automation.
- Replace periodic review with continuous evidence capture Collect action logs, decision traces, and policy violations in near real time so governance teams can detect drift before the next audit cycle.
What's in the full article
Lasso Security's full analysis covers the operational detail this post intentionally leaves for the source:
- How the vendor distinguishes runtime AI governance from periodic GRC workflows
- The specific control requirements used to evaluate AI usage control, observability, and enforcement
- The market framing around AI governance, AI agent identity, and AI cybersecurity governance
- The vendor's view of duplicated tooling and inflated end-to-end coverage claims
👉 Read Lasso Security’s analysis of Gartner’s 2026 AI governance and agent identity coverage →
AI governance technologies: are your controls keeping up at runtime?
Explore further
16/09/2026 9:21 am
Runtime enforcement is now the dividing line between AI governance theatre and real control. If policies only exist as documentation, autonomous systems will outpace them. The governance model that matters is one that can inspect and block actions while an AI system is operating, not only report on what happened later. For practitioners, the question is whether policy is merely recorded or actually enforced.
A question worth separating out:
Q: What should teams prioritise first: guardrails, observability, or access controls for AI systems?
A: Access controls should come first because they define what the system can touch, while guardrails and observability shape how it behaves and how it is investigated. If permissions are too broad, the other controls are compensating for a broken trust model. Start with least privilege, then add enforcement and evidence.
👉 Read our full editorial: AI governance technologies need runtime enforcement, not policy checkboxes
