92% of Enterprises Can't See Their AI Agents

There is a new report out from Cybersecurity Insiders and Saviynt that should be mandatory reading for every CISO shipping AI into production. The headline: 92% of enterprises lack full visibility into their AI identities. But the details underneath are worse.

#The Numbers

The 2026 CISO AI Risk Report surveyed 235 CISOs, CIOs, and senior security leaders across US and UK enterprises with 5,000+ employees. Here is what they found:

71% of security leaders confirm AI tools have access to core systems like Salesforce and SAP. Only 16% say that access is governed effectively.

92% lack full visibility into AI identities operating in their environment. 95% doubt their ability to detect or contain misuse if it happened.

75% have already found unsanctioned AI tools running inside their networks.

A separate SANS Institute survey from April 2026 confirms the pattern: 76% of organizations report growth in non-human identities, 74% are deploying AI systems that need credentials and access permissions to operate autonomously, and 92% fail to rotate machine credentials on a 90-day cycle.

And from a Security Boulevard analysis: 97% of enterprises expect a material AI-agent-driven security incident within the next 12 months.

Ninety-seven percent expect it to happen, and 92% cannot see it coming.

#The Identity Problem AI Created

To understand why this matters, you need to understand how AI agents interact with enterprise systems.

Every AI agent that touches your infrastructure needs an identity: an API key, an OAuth token, a service account, a set of credentials that let it authenticate, authorize, and act. In traditional IT, these are called non-human identities, or NHIs. Service accounts, automation bots, CI/CD runners. They have existed for decades.

What changed is the scale and the behavior.

Non-human identities now outnumber human users by 25 to 50 to one in most enterprises. Some organizations report ratios of 100:1 or even 500:1. And unlike traditional service accounts, which follow fixed logic and do the same thing every time, AI agents are nondeterministic. They reason. They delegate. They make decisions. They act independently across domains and systems.

A traditional NHI is a cron job that pulls data from a database at 3am. An AI agent is a system that decides which database to query, interprets the results, takes action based on what it finds, and potentially delegates sub-tasks to other agents. The identity model that worked for the cron job does not work for the agent.

97% of NHIs have excessive privileges. An agent that needs read access to one dataset holds a token that grants write, delete, and administrative access across production systems. 71% of non-human identities are not rotated within recommended timeframes. That proof-of-concept service account from 2024 still has production access today.

#The Vercel Breach Was a Preview

If this sounds theoretical, it is not. We just saw what ungoverned AI identity access looks like in practice.

Two days ago, Vercel confirmed a breach that originated at Context AI, a third-party AI tool. A Vercel employee connected Context AI to their corporate Google Workspace via OAuth. Attackers compromised Context AI, used the OAuth connection to pivot into the employee's Google account, and from there accessed Vercel's internal systems, including unencrypted credentials.

The breach did not start with a phishing email. It did not start with a stolen password. It started with an AI tool that had OAuth access to a corporate account. That is the attack pattern the Saviynt report is describing at scale.

75% of organizations have found unsanctioned AI tools in their environments. Each of those tools has credentials. Each of those credentials is an attack surface. And 92% of organizations cannot see them.

#Why Traditional IAM Fails Here

Identity and Access Management was designed for a world where identities are human, sessions are interactive, and access patterns are predictable. None of those assumptions hold for AI agents.

78% of organizations do not have formal policies for creating or removing AI identities. There is no onboarding process for an AI agent the way there is for an employee. No offboarding process when a pilot ends. No access review when the agent's scope changes.

Only 21% maintain a real-time inventory of active agents. Nearly 80% of organizations deploying autonomous AI cannot tell you, in real time, what those systems are doing or who is responsible for them.

92% of security professionals are not confident their legacy IAM tools can manage the risks AI agents bring. And they are right. Legacy IAM was built for a world of human users with predictable behavior. AI agents operate at machine speed, across system boundaries, with behavior that changes based on context.

The Cloud Security Alliance frames the core question: when an AI agent takes an action, who is responsible? The agent? The developer who deployed it? The vendor who built it? The employee who connected it? Traditional accountability models do not have an answer.

#The Triple Threat

Saviynt identifies a triple threat that makes AI identity governance fundamentally different from anything enterprises have managed before:

Non-human identity sprawl. The sheer number of machine identities has grown beyond what manual governance can track. When your NHI-to-human ratio is 50:1, you cannot review each identity quarterly the way you review employee access.

Agentic risk. AI agents do not just execute fixed logic. They reason, interpret, and act autonomously. An agent with administrative privileges operating at machine speed is functionally an over-privileged insider that never sleeps, never takes vacation, and never triggers the behavioral anomaly patterns your SIEM was trained on.

Governance speed mismatch. Organizations are trying to govern machine-speed identities using human-speed manual processes. The agent can create, use, and discard credentials faster than the security team can review them.

48% of cybersecurity professionals believe agentic AI will be the top attack vector by end of 2026. Palo Alto's Unit 42 found that identity loopholes drove nearly 90% of their 2026 incident response investigations.

#What Needs to Change

The Saviynt report and the SANS survey converge on the same set of requirements:

Inventory everything. You cannot govern what you cannot see. Every AI agent, every service account, every OAuth token, every API key needs to be in a single inventory with ownership, scope, and expiration metadata. The 21% who maintain real-time inventories have a massive advantage over the 79% who do not.

Apply least privilege aggressively. 97% of NHIs have excessive privileges. Every agent should have the minimum permissions required for its task, scoped to specific resources, with time-bound access that expires automatically. No more permanent admin tokens for proof-of-concept projects.

Rotate credentials on a machine-speed cadence. 92% fail to rotate on a 90-day cycle. For AI agents, 90 days is too long. Short-lived credentials, automatic rotation, and just-in-time access provisioning should be the default.

Monitor for behavioral anomalies. AI agents behave differently from humans, but they also behave differently from each other. Baseline each agent's normal operating pattern and alert on deviations. An agent that suddenly queries databases it has never accessed before is a signal.

Govern the supply chain. The Vercel breach started at a third-party AI tool. Every AI vendor your employees connect to is an extension of your attack surface. OAuth grants to third-party AI tools need the same scrutiny as vendor access reviews.

Build an accountability framework. When an AI agent takes an action, there must be a clear chain: which agent, under whose authority, with what permissions, for what purpose. Without this, incident response is impossible.

#The Clock Is Running

The Saviynt report makes the timeline explicit. 97% of enterprises expect a material AI-agent-driven incident within 12 months. The organizations that get AI identity governance right will contain those incidents. The organizations that do not will discover, the hard way, that the most dangerous insider in their environment is not a person.

It is an agent nobody remembered deploying, with credentials nobody rotated, accessing systems nobody monitored, under a governance framework that does not exist.