Agentic AI and NHI sprawl: what identity teams should prepare for

TL;DR: C1.ai's 2025 Future of Identity Security Report, based on 494 security professionals, finds that 89% plan to implement AI agents, 93% see NHI risk as urgent, and 82% experienced an identity-driven attack or breach in the past year. The pattern is not just adoption pressure, but a shift to runtime governance across autonomous and non-human identities.

Editorial analysis by NHI Mgmt Group, based on content published by C1.ai: “Key Takeaways From the 2025 Future of Identity Security Report”.

By the numbers:

• 89% of respondents say they plan to implement AI agents in their security departments within the next two years.
• 82% of organizations experienced at least one identity-driven cyberattack or data breach in the past year.
• 93% of security leaders said the risks associated with NHIs are urgent.

Key questions

Q: How should security teams govern AI agents and NHIs differently?

A: Security teams should govern NHIs as predictable machine identities and AI agents as runtime actors that can alter behaviour after authentication.

Q: Why do over-provisioned NHIs create such a large security risk?

A: Because non-human identities often operate continuously, connect to sensitive systems, and are difficult to review manually.

Q: What signals show that identity controls are not keeping up with agentic AI?

A: Look for tool calls that are hard to attribute, access that expands across multiple services in one session, and approvals that do not explain the eventual action chain.

Practitioner guidance

• Map identity controls by actor type Separate human IAM, NHI governance, and autonomous agent oversight into distinct control paths so each actor type is managed to its own lifecycle and runtime risk.
• Inventory and classify all NHIs Build an authoritative inventory of service accounts, API keys, tokens, and certificates, then tie each item to an owner, business purpose, and rotation expectation.
• Restrict agent tool scope at runtime Constrain which tools and data sources an agent can use in production, and treat any expansion of scope as a governance decision rather than a convenience setting.

Bottom line: The report shows that agentic AI adoption and NHI risk are climbing together, not as separate issues but as one expanding identity governance problem.

What's in the full report

C1.ai's full blog covers the operational detail this post intentionally leaves for the source:

• The full survey breakdown behind the 494 security professionals and how the responses vary by industry.
• Additional detail on the reported rise in identity-driven attacks and how leaders are translating that pressure into budget decisions.
• The article's own framing of why security teams are adopting agentic AI despite the risks.
• Context on the specific NHI concerns the report surfaces, including over-provisioning and long-lived credentials.

👉 Read C1.ai's report on agentic AI adoption and rising NHI risk →

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →