Topic starter
12/06/2026 9:37 pm
TL;DR: Credential theft and AI agent sprawl are colliding across identity programmes, with 642.4 million credentials stolen from infostealer infections in 2025 and 56% of non-human identities sitting outside structured governance, underscoring how legacy IAM controls are no longer enough when identities, applications and agents must be governed continuously, according to Josys.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “Enterprise Identities Are Under Siege. Josys Is Changing How Organizations Fight Back.”.
By the numbers:
- 642.4 million credentials were stolen from infostealer infections in 2025 alone, according to SpyCloud research cited by Josys.
- 56% of non-human identities sit entirely outside structured governance, according to Gartner research cited by Josys.
Key questions
Q: What should teams do first when leaked credentials are discovered in active identities?
A: Treat the exposure as a live access event, not a forensic note.
Q: Why do AI agents need special governance compared with normal applications?
A: AI agents make decisions about which tools to use and how to use them, so they can be manipulated by malicious context as well as code.
Q: Where do periodic access reviews fail in SaaS-first identity programmes?
A: They fail when access, policy and configuration drift faster than the review cadence can observe.
Practitioner guidance
- Map identity exposure to live application access Correlate leaked credentials from stealer logs, paste sites and dark web sources to the accounts and applications those identities can still reach, then revoke exposed access before manual review cycles catch up.
- Inventory AI agents as governed identities Create a canonical register for agents with ownership, purpose, approved scopes, connected systems and policy status so that AI agents are visible in the same control plane as human and machine identities.
- Shift from periodic certification to continuous enforcement Use real-time policy checks to detect entitlement drift, misconfiguration and unauthorised access changes across SaaS applications, then trigger automated remediation when the policy boundary is crossed.
Bottom line: Credential theft and unmanaged AI agents are converging into one identity governance problem that older IAM models do not handle well.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:49 pm
Credential exposure is now a governance event, not just a security alert. When leaked credentials can be matched to live access and remediated automatically, the boundary between threat detection and identity governance collapses. Organisations that still treat exposure as a ticket to work later are governing the wrong moment in the lifecycle. The practical conclusion is that exposure monitoring belongs inside identity governance, not beside it.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Governing AI agents as users usually misses the operational reality that they are automated entities acting across systems, not people following a fixed workflow. Treating them as non-human identities forces clearer controls for authentication, authorization, task scoping, logging, and revocation. That model better fits machine-run access and makes it easier to apply least privilege consistently.
👉 Read our full editorial: AI-native identity governance now has to cover agents and leaks