AI agents are rapidly becoming part of most enterprises, but many organizations deploy agents more quickly than they can govern them.
Security leaders know this, as they are nearly unanimous in their concern about AI-driven threats. Yet relatively few feel confident they know where their agents are, what those agents can access, or what actions they are authorized to perform.
The result is a dangerous gap between
AI adoption and AI governance — a chasm that legacy identity infrastructure was never designed to close.
The challenge is not simply building better AI models. It's also about creating an
identity architecture that gives organizations continuous visibility, granular control and accountability over every human and non-human identity.
What CISOs worry about when it comes to AI agents
Okta's just-released Global CISO Insights 2026 report analyzes a global survey of 306 security executives who have widespread concern about AI governance.
Eighty-one percent of CISOs and other top security managers worry about excessive AI access. Fewer than half are confident that they can identify every AI agent in their environment (47%); control what those agents can access (46%); or determine what individual agents are allowed to do (45%).
"Even among CISOs who are fully confident they know where their AI agents are, roughly 80% remain highly concerned about excessive access and permissions," the report notes.
AI-powered
phishing (61% of respondents), malicious AI agents (49%) and deepfake authentication bypass (54%) rank among the threats keeping security leaders awake at night.
Yet many CISOs also report organizational challenges, with only 31% worldwide — and just 12% in the U.S. — saying they are fully aligned with their C-suites and boards on acceptable levels of AI risk.
Overall, CISOs and other security managers said that non-technical executives view AI security primarily as a
compliance issue rather than a business enabler. As a result, governance initiatives may struggle to receive adequate investment.
Why traditional identity management can't properly govern AI agents
Many organizations are attempting to govern AI agents using identity models originally designed for human employees and conventional software.
According to the Okta survey, one in four organizations applies the same identity-lifecycle policies to AI agents as to human users, while 21% rely on shared credentials or broad-permission service accounts. Another 20% leave agent management to individual teams on an ad-hoc basis.
Those approaches aren't sufficient because AI agents behave differently from people. They can act autonomously, invoke multiple tools, make decisions dynamically and operate continuously without predictable execution paths.
Traditional identity systems assume fixed permissions and relatively static lifecycles, which create blind spots when applied to non-human identities.
"When we talk about governance, we're talking about treating those AI identities as first-class identities," explains Okta Regional CSO Matt Immler.
That means giving every agent a responsible human owner, clearly defining the data the AI agent can access, the scope in which it can operate, and the decisions it is permitted to make.
How to strengthen your AI governance
Okta's report outlines a practical roadmap for improving AI identity governance.
The first priority is full visibility. Organizations cannot govern agents they cannot discover, so security teams should inventory where agents operate, to which systems they connect and what actions they perform.
Second, shared credentials should be replaced with individual identities, even for AI agents, each governed by its own lifecycle, permissions and access policies.
Organizations should also resist simply blocking shadow AI. Instead, they should establish repeatable processes for evaluating, onboarding and governing new AI tools so employees have secure alternatives that match the pace of innovation.
Finally, CISOs should strengthen alignment with executive leadership by presenting identity governance as an enabler of responsible AI adoption rather than an obstacle to innovation.
The survey results make clear that organizations with mature AI identity governance — per the report, those with "automated, real-time access controls, continuous monitoring, and dynamic governance for all human and AI identities" — experience fewer instances of shadow AI, lower concern about breaches and faster containment of rogue agents than those relying on reactive approaches.
Organizations that build this modern identity foundation will be better positioned to scale AI safely while maintaining the control necessary to keep innovation aligned with security.
