Topic starter
06/11/2026 6:55 pm
TL;DR: AI agent sprawl is creating cost and security exposure because agents can keep running without a central inventory, owner, or access review, according to AvePoint's analysis. Practitioners need governance that links discovery, spend and permission scope before agents become invisible liabilities.
Editorial analysis by NHI Mgmt Group, based on content published by AvePoint: “How Much Is Ungoverned AI Agent Sprawl Costing You?”.
By the numbers:
- Gartner projects the average Fortune 500 enterprise will run more than 150,000 AI agents by 2028, up from fewer than 15 in 2025.
- Only 13% of organizations believe they have adequate governance in place for that growth.
- AvePoint's State of AI 2026 report found 86% of organizations delayed AI agent deployments by an average of nearly six months due to unresolved data security and data management concerns.
Key questions
Q: Why do AI agents need named owners and lifecycle reviews?
A: AI agents need named owners and lifecycle reviews so someone is accountable for their delegated authority, tool access, data reach and revocation when the agent is no longer needed or changes purpose.
Q: How should teams govern AI tool access without slowing adoption?
A: Use the same identity lifecycle controls you already apply to critical enterprise systems, then automate provisioning, role updates, and revocation so governed access is faster than ad hoc approvals.
Q: How should security teams inventory AI agents across SaaS, cloud, and low-code platforms?
A: Security teams should inventory AI agents by linking each connected identity to its owner, permissions, data sources, and execution scope across every platform they touch.
Practitioner guidance
- Implement continuous AI agent discovery Scan every cloud and SaaS environment for sanctioned and shadow agents, then maintain a live inventory with owner, purpose, data scope and retirement date.
- Bind every agent to a named accountable owner Require one accountable business or technical owner per agent so no deployment can remain unreviewed, unowned or impossible to decommission.
- Re-certify agent access on a fixed cadence Review each agent’s data connections and permissions at a set interval, and remove access when the business purpose has changed or ended.
Bottom line: AI agent sprawl creates cost leakage and security exposure at the same time, because agents keep spending and accessing data after their original purpose has faded.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
AI agent sprawl is an identity governance problem before it is a productivity problem. The critical failure is not that organisations are building agents too quickly, but that they are treating agents as disposable workflow components instead of governed identities with owners, scope and retirement dates. Once an agent can act, access data and persist beyond the project that created it, it belongs inside the same control model used for other privileged non-human identities. The practitioner conclusion is simple: govern the agent as an identity object, not as a software feature.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 69% of organisations still authenticate machine identities with long-lived API keys, according to the 2026 State of AI Agent Identity Security Report.
A question worth separating out:
Q: How do AI agents and unsanctioned AI use differ?
A: AI agents are provisioned and governed software identities with an accountable owner, defined scope, approved tool access and reviewable controls. Unsanctioned AI use is shadow use of AI tools or models without approval, often outside policy, logging or data controls. The key difference is whether identity, access and oversight are formally assigned.
👉 Read our full editorial: AI agent sprawl turns governance gaps into hidden cost and access risk