Topic starter
16/01/2026 12:40 pm
TL;DR: 2025 brought $20 million in Series A funding, rapid enterprise adoption, and new capabilities for discovering, governing, and retiring AI agent identities across enterprise environments, according to Token Security. The real shift is that AI agents are being treated as identities with lifecycle, ownership, and privilege boundaries, not just as tools with access.
Editorial analysis by NHI Mgmt Group, based on content published by Token Security: “2025: A Year of Momentum and Innovation for Token Security”.
By the numbers:
- Token Security raised $20 million in Series A financing in January 2025, bringing total funding to $28M.
Key questions
Q: What breaks when AI agents are discovered but not lifecycle-managed?
A: Discovery alone breaks down because the organisation still cannot tell who owns the agent, whether it is still needed, or when its access should end.
Q: Why do AI agents need human ownership and offboarding controls?
A: Because an AI agent can outlive the project, prompt, or workflow that created it.
Q: How do organisations know whether AI agent access is still appropriate?
A: Compare the agent’s observed actions, data access, and system interactions against the original intent description.
Practitioner guidance
- Define AI agent lifecycle states Create explicit lifecycle states for AI agents, from requested and approved through active, suspended, and retired, so governance is tied to identity state rather than ad hoc usage.
- Require named ownership before activation Do not allow an AI agent or custom GPT to go live until a human owner is recorded, accountable for access scope, and responsible for retirement decisions.
- Scope access to declared purpose Match each AI agent’s permissions to the task it is meant to perform, then review whether the access still fits after prompt, tool, or workflow changes.
Bottom line: AI agent identity security is moving toward lifecycle control, which means ownership and offboarding now matter as much as discovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 6:42 pm
AI agent identity governance is now a lifecycle problem, not a visibility problem: discovery matters, but discovery without ownership, scope, and retirement leaves the security team with an inventory rather than control. Token Security’s 2025 review reflects a broader market truth that AI agents are becoming durable identities inside enterprise environments. The practitioner conclusion is that AI agent governance has crossed from detection into lifecycle management.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations apply lifecycle governance to service accounts and AI agents?
A: They should apply the same joiner-mover-leaver discipline used for employees, but with actor-specific controls for creation, ownership, rotation, delegation, and revocation. Service accounts and AI agents do not leave through resignation, so offboarding must be event-based, explicit, and traceable across the systems they can access.
👉 Read our full editorial: AI agent identity security is shifting from visibility to lifecycle control