Topic starter
30/07/2026 11:22 pm
TL;DR: C1.ai says its agentic security and intelligence layer inventories humans, non-human identities, and AI agents, turns findings into governed remediations, and attaches approval workflows and audit trails, while citing Palo Alto Networks' 2026 Identity Security Landscape figure of 109 machine identities for every human identity. Discovery is no longer the hard part; proving ownership, remediation, and exception handling across identity types is the real governance test.
Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “C1 Launches Agentic Security and Intelligence to Close Identity Risk”.
By the numbers:
- Organisations now manage 109 machine identities for every human identity, according to Palo Alto Networks' 2026 Identity Security Landscape cited by C1.ai.
Key questions
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: What breaks when identity findings are tracked in one tool and remediated in another?
A: You lose the evidence chain.
Practitioner guidance
- Define ownership for every identity class Require a named owner for workforce accounts, service accounts, and AI agents before they are granted meaningful access.
- Unify identity findings into one case workflow Route identity risk findings into a single remediation process that preserves approval history, exception state, and closure evidence across tools.
- Classify service accounts and AI agents consistently Create a common classification scheme so misclassified identities can be flagged as findings, not just inventory issues.
Bottom line: The article's central problem is not identity discovery but proving accountable remediation across humans, NHIs, and AI agents.
What's in the full announcement
C1.ai's full article covers the operational detail this post intentionally leaves for the source:
- How the intelligence graph maps workforce identities, service accounts, and AI agents across connected systems
- How findings are converted into remediations with approval workflows, revocation paths, and audit trails
- How the API, ServiceNow, Jira, and PagerDuty handoffs work in practice
- How teams can assign ownership and auto-resolve an unowned service account
👉 Read C1.ai's article on agentic security and identity risk governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:24 pm
Governed remediation is now the real identity control plane: Discovery across humans, NHIs, and AI agents only matters if it resolves into a closed governance loop. The article reflects a market shift away from visibility-only tooling toward accountable remediation, because modern estates fail when findings cannot be assigned, approved, and evidenced. Practitioners should treat closure quality as a control in its own right.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations measure whether identity governance is actually working?
A: Organisations should measure whether governance reduces incident cost, manual workload, and time to detect or contain risky access. If the only visible improvement is fewer tools, the programme may not be effective. Strong governance shows up in faster policy enforcement, clearer ownership, and fewer unreviewed access paths.
👉 Read our full editorial: Agentic security and intelligence reframes identity risk governance