Topic starter
19/08/2026 3:30 pm
TL;DR: AI agents expose a deeper security flaw: most organisations still cannot reliably classify sensitive data or determine who and what can access it, according to Sentra. The decisive control is continuous data readiness, because visibility without classification leaves AI governance blind to the real exposure, and OWASP research says 68% cannot distinguish human from agent activity.
Editorial analysis by NHI Mgmt Group, based on content published by Sentra: “Why AI Agents Are Exposing a Problem CISOs Have Had All Along”.
By the numbers:
- 68% of organisations cannot reliably distinguish human activity from AI agent activity.
Key questions
Q: What breaks when AI agents are added before data is classified?
A: Security teams lose the ability to judge whether an AI workflow is actually risky because access reviews and agent counts do not reveal what sensitive data is reachable.
Q: Why do unclassified datasets create AI governance risk?
A: Unclassified data can be reached by humans, service accounts, or AI agents without anyone recognising that the access path leads to something sensitive.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Practitioner guidance
- Implement continuous data classification Classify sensitive data continuously across cloud, SaaS, collaboration platforms, and data warehouses so access decisions reflect current exposure, not last quarter's inventory.
- Map identities to sensitive datasets Build and maintain a living map of which humans, service accounts, applications, and AI agents can reach each sensitive dataset, then prioritise the highest-risk paths first.
- Right-size access before AI enablement Require explicit justification for any AI workflow that can touch regulated, financial, HR, or customer data, and remove unnecessary entitlements before rollout.
Bottom line: AI agent visibility alone does not tell security teams whether the underlying data is sensitive, which is why exposure remains hard to quantify.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:13 pm
AI visibility is a downstream metric, not the control boundary. The article correctly shifts attention away from counting agents and toward what those agents can reach. That is the real governance boundary because the exposure sits in the data estate, not in the presence of automation itself. For practitioners, the question is whether classification and access governance are current enough to support AI at all.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern human and non-human access during mergers?
A: They should treat both as part of the same identity estate. Human onboarding, service account inheritance, API keys, and integration credentials can all introduce hidden access paths if they are not reviewed together. A merger is the wrong time to separate IAM from machine identity governance.
👉 Read our full editorial: AI data readiness is the real gap behind agent visibility