Topic starter
12/06/2026 9:41 pm
TL;DR: Most organisations still cannot distinguish human from AI agent activity inside their systems, according to Cyera's analysis of AI governance. That visibility gap makes it hard to bind data controls, identity controls, and accountability to runtime access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Cyera Raises $600 Million at $12 Billion Valuation to Continue Building the Trust Layer for the AI Era”.
By the numbers:
- 68% of organisations cannot distinguish human from AI agent activity inside their own systems.
- Cyera raised $600 million at a $12 billion valuation.
- Cyera shipped more than 100 new product capabilities across DSPM, privacy, identity, DLP, and agentic security.
Key questions
Q: Why do AI security programs need both data controls and identity controls?
A: Because data controls show where sensitive information lives, while identity controls determine who or what can reach it.
Q: What are the signs that AI access controls are too weak for sensitive enterprise data?
A: Weak controls usually show up when teams cannot easily see where AI is being used, what data it can reach, and who can invoke it.
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model.
Practitioner guidance
- Classify actor type before policy design Map each AI-facing workflow to human, NHI, or autonomous behaviour so access, logging, and review rules are applied to the right actor class.
- Unify identity and data scopes Tie sensitive-data classification to the identities and agents that can reach it, then verify that the resulting policy can be enforced at runtime.
- Test runtime privilege boundaries Check whether your current entitlements can describe what an AI system may infer, request, or execute during a live task, not just at provisioning time.
Bottom line: The core problem is not AI capability alone, but the inability to distinguish human from agent activity well enough to govern it.
Glossary terms: Trust layer, Actor Typing, Runtime Governance, Permission Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 11:55 pm
AI governance is now an actor-classification problem, not only a data problem. Cyera’s own numbers point to a basic failure of attribution: many organisations cannot separate human action from AI agent action inside their environments. That means the first governance question is who or what is acting, before any policy, access, or data decision can be trusted. The implication is that identity programmes must treat actor typing as a control prerequisite, not an afterthought.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What happens when AI systems are granted static permissions for dynamic work?
A: Static permissions can over-grant because they assume the actor’s needs are stable, but AI tasks often change scope mid-session. The result is permission drift, poor explainability, and weak accountability when the system crosses from analysis into action. Organisations should treat that as a governance failure, not a tuning issue.
👉 Read our full editorial: Cyera’s $600 million round signals trust-layer demand for AI governance