Topic starter
14/05/2026 5:38 pm
TL;DR: 91% of organisations have little to no visibility into AI identities, leaving agents, tools, and data sources hard to govern, audit, and contain before access risk compounds, according to Saviynt. Visibility is only the starting point; lifecycle governance and runtime authorization determine whether AI identity risk stays observable or becomes operationally dangerous.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “You Can't Secure What You Can't See: Posture Management for AI Agents”.
By the numbers:
- 91% of organisations have little to no visibility over AI identities, according to Saviynt's 2026 CISO AI Risk Report.
- Saviynt says 91% of organisations have little to no visibility into AI identities, creating a critical blind spot that grows as agents spread.
Key questions
Q: What breaks when teams rely on visibility without enforcement for AI agents?
A: Visibility without enforcement breaks the governance model because it creates knowledge without control.
Q: Why do AI agents create more risk than a simple model inventory suggests?
A: AI agents create more risk because they do not just answer prompts, they collect capabilities and execute actions in loops.
Q: How can security teams tell whether AI posture management is actually working?
A: It is working when teams can answer four questions quickly and consistently: who owns the agent, what it can access, which guardrails apply, and when access changed.
Practitioner guidance
- Inventory AI agents as identity graphs Map each agent together with its model, tools, data sources, and human owner so governance can follow the access relationship, not just the object name.
- Assign ownership to every orphaned agent Create an explicit owner for each agent that can access enterprise systems, and treat orphaned agents as unresolved governance exceptions until ownership is assigned.
- Track configuration drift continuously Review changes to tool connections, data-source access, and guardrails as ongoing risk signals, because AI identity posture changes after deployment.
Bottom line: The article’s central risk is that AI agents are now present in environments where many organisations still cannot see, own, or govern them properly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
This topic was modified 3 days ago 2 times by NHI Mgmt Group
14/05/2026 5:40 pm
AI agent posture management fills an identity governance gap, not just a discovery gap. Discovery matters, but it is only the first control plane. Once an AI agent can act across tools and data sources, the governance question becomes who owns it, what it may touch, and how drift is detected. The practitioner conclusion is simple: visibility must be paired with lifecycle and authorization controls.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams do when browser telemetry reveals shadow AI usage?
A: Reconcile the service to an owner, decide whether it belongs in approved access pathways, and ensure offboarding and review rules apply to every linked account and session. If the service cannot be governed, the issue is not visibility alone but an access path that should not remain open.
👉 Read our full editorial: AI agent posture management exposes the enterprise visibility gap
This post was modified 5 days ago by NHI Mgmt Group