Topic starter
23/03/2026 2:29 pm
TL;DR: 96% of enterprise permissions go unused, while static profiles, broad admin assignments, and dormant entitlements leave a large hidden access surface that AI agents can inherit and actively exercise at machine speed, according to Cyera research. Access governance now has to assume unused rights are still operationally real.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “96% of Enterprise Permissions Go Unused. AI Agents Won't Leave Them That Way.”.
By the numbers:
- 96% of enterprise permissions go unused in the environments Cyera Research analysed.
- Only 4 in 100 workers take any action at all in most enterprise applications over a 90-day period.
- More than 80% of access is managed through static permission profiles across enterprise SaaS environments.
Key questions
Q: What should teams do when most permissions go unused but still remain active?
A: Treat unused access as live exposure, not harmless clutter.
Q: Why do AI agents and copilots create more risk when they inherit broad enterprise permissions?
A: AI agents and copilots create more risk when they inherit broad enterprise permissions because their access can extend beyond their business purpose.
Q: Where do enterprise permissions fail when they are mapped to agents?
A: They fail at the point where a permission model assumes human restraint.
Practitioner guidance
- Audit actual permission use before agent rollout Compare exercised access over the last 90 days with assigned permissions so dormant rights can be removed before any agent inherits them.
- Create dedicated non-human identities for agents Do not let agents inherit employee accounts, profile bundles, or standing human entitlements; scope each identity to one task or workflow.
- Reduce platform-wide override permissions first Prioritise permissions such as broad read, write, and delete overrides because they determine the largest possible blast radius in enterprise platforms.
Bottom line: Most enterprise permissions sit unused, but they still represent real access that can be activated by non-human actors.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:28 pm
Dormant privilege is now active risk, not idle inventory. The article shows that most enterprise access goes unused, but unused does not mean harmless when the same permissions can be inherited by an AI agent. This is where traditional access governance fails as a planning model, because dormant entitlements are still technically live and immediately usable. The practitioner conclusion is that access depth matters less than the ability to execute it.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- According to PwC, 79% of organizations have already adopted AI agents to some degree.
A question worth separating out:
Q: What should security teams do first if Salesforce access has never been formally reviewed?
A: Start with the highest-risk permissions. Verify that only administrators have the System Administrator profile, then map who can view and edit sensitive data across roles and permission sets. From there, tighten access to the least privilege needed for each job function. That sequence gives the fastest reduction in exposure without waiting for a full redesign.
👉 Read our full editorial: AI agent permissions expose dormant access at enterprise scale