Topic starter
02/06/2026 7:03 pm
TL;DR: Fragmented data visibility and faster NHI access leave AI governance unable to keep up with sensitive information, according to Cyera's analysis of this gap. Security teams need continuous discovery, right-sized permissions, and runtime protection to turn policy into enforcement.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “What Keeps CDOs Up at Night: The Visibility Gap”.
Key questions
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: What are the signs that AI governance is failing in the enterprise?
A: Common warning signs include rapid growth in AI use without matching policy coverage, sensitive files being copied into personal accounts, and a large share of AI apps carrying high or critical risk.
Q: How should security teams govern AI agents that reason across multiple data platforms?
A: Security teams should govern the meaning layer, not just the access layer.
Practitioner guidance
- Establish continuous data discovery Map where sensitive data resides across SaaS, cloud, and on-prem systems, then tie each location to the identities and tools that can reach it.
- Right-size human and NHI permissions Review service accounts, embedded AI integrations, and user access together so overprivileged identities do not expand the blast radius of AI-enabled workflows.
- Classify sanctioned and shadow AI tools Maintain an inventory of approved and unapproved AI tools, then document which datasets each tool can access before it is used in production workflows.
Bottom line: AI governance breaks when organisations cannot continuously see where sensitive data lives or which identities can reach it.
Glossary terms: Data Visibility, Overprivileged Nhi, Runtime Protection, Shadow AI
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
02/06/2026 7:21 pm
AI governance now fails at the boundary between data visibility and identity scope. Cyera's analysis shows that the central problem is no longer whether governance exists, but whether the organisation can observe how data is actually reached and moved. When access paths change faster than review cycles, policy becomes documentary rather than operative. The practitioner conclusion is that governance must be judged by observable behaviour, not declared coverage.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: They should move enforcement closer to the workflow by combining continuous discovery, right-sized permissions, and runtime protection. That reduces the chance that a prompt, retrieval, or response can expose data before a reviewer notices the access pattern.
👉 Read our full editorial: AI governance is failing where data visibility and NHI access collide