Topic starter
12/06/2026 9:41 pm
TL;DR: 68% of organisations cannot distinguish human from AI agent activity inside their systems, a visibility gap that many AI programmes stall on, according to Cyera; the company also says it raised $600 million at a $12 billion valuation and has shipped 100-plus product capabilities. The signal is bigger than funding: identity and data governance are converging around what AI can see and do.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “Cyera Raises $600 Million at $12 Billion Valuation to Continue Building the Trust Layer for the AI Era”.
By the numbers:
- 68% of organisations cannot distinguish human from AI agent activity inside their own systems.
- Cyera raised $600 million at a $12 billion valuation.
- Cyera shipped more than 100 new product capabilities across DSPM, privacy, identity, DLP, and agentic security.
Key questions
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model.
Q: Why do AI security programs need both data controls and identity controls?
A: Because data controls show where sensitive information lives, while identity controls determine who or what can reach it.
Q: What are the signs that AI access controls are too weak for sensitive enterprise data?
A: Weak controls usually show up when teams cannot easily see where AI is being used, what data it can reach, and who can invoke it.
Practitioner guidance
- Classify actor type before policy design Map each AI-facing workflow to human, NHI, or autonomous behaviour so access, logging, and review rules are applied to the right actor class.
- Unify identity and data scopes Tie sensitive-data classification to the identities and agents that can reach it, then verify that the resulting policy can be enforced at runtime.
- Test runtime privilege boundaries Check whether your current entitlements can describe what an AI system may infer, request, or execute during a live task, not just at provisioning time.
Bottom line: The core problem is not AI capability alone, but the inability to distinguish human from agent activity well enough to govern it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 11:55 pm
AI governance is now an actor-classification problem, not only a data problem. Cyera’s own numbers point to a basic failure of attribution: many organisations cannot separate human action from AI agent action inside their environments. That means the first governance question is who or what is acting, before any policy, access, or data decision can be trusted. The implication is that identity programmes must treat actor typing as a control prerequisite, not an afterthought.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What happens when AI systems are granted static permissions for dynamic work?
A: Static permissions can over-grant because they assume the actor’s needs are stable, but AI tasks often change scope mid-session. The result is permission drift, poor explainability, and weak accountability when the system crosses from analysis into action. Organisations should treat that as a governance failure, not a tuning issue.
👉 Read our full editorial: Cyera’s $600 million round signals trust-layer demand for AI governance
This post was modified 1 day ago by NHI Mgmt Group