AI Agents Are Scaling Faster Than They’re Governed
Something has quietly changed inside the enterprise. A new workforce has clocked in: tireless, fast and already trusted with the keys. Three in four enterprise leaders say they are already adopting agentic AI.[1] The widespread adoption is drawn by a promise too big to ignore: faster decisions, work that never sleeps, and scale no team can match.
But governance has not kept pace. Agents are deployed faster than security can register them, given credentials no one reviews, and connected to systems no single team watches end to end. More than half of enterprises report agentic sprawl even after adopting a formal AI risk framework.[2]
The same autonomy that makes agents valuable makes them dangerous: they can reach far more than anyone intended, and nobody is counting.
When something goes wrong, every investigation comes down to three questions. With AI agents in the mix, most teams can't answer them.
Three questions this guide helps you answer
The human, machine or AI agent behind the action.
The account, token or role behind it, and who owns it.
Every system it can touch, and the path to your crown jewels.
If your team can't answer all three quickly, this guide is for you.
PART 1 · THE CHALLENGE
Every AI Agent Runs on Borrowed Keys
Most attacks no longer need to break anything. They borrow access that already exists.
A developer's cloud role, a pipeline's service principal, a finance bot's OAuth grant: each carries privileges, and each privilege is a possible route to critical systems. And most of these identities today aren't people. They're service accounts, tokens and, increasingly, AI agents that no one reviews the way they review employee access.
Three Blind Spots Attackers Count On
In Verizon's 2026 DBIR, exploited vulnerabilities overtook credential abuse as the top way into breaches, at 31% versus 13%.[3] Real attacks chain the two: a weak identity next to a vulnerable host. Most teams still review them apart.
Permissions are handed out to keep projects moving and rarely taken back, so credentials outlive the people, projects and agents they were created for.
Each identity and security tool answers part of the question, but none sees the agent's behavior, the host's exposure and the identity relationships together.
Tool
Agent Behaviour
Host Exposure
Identity Relationship
Proof of Exploitability
IAM and IDaaS
Who can log in
No
No
Partial
No
PAM
Vaulted privileged account
No
No
Partial
No
IGA
Access reviews on a cycle
No
No
Partial
No
Attack-path tool
How identities connect
No
Partial
Yes
No
Vulnerability management
Flaws on hosts
No
Yes
No
No
SIEM
Alert from written rules
Partial
No
No
No
What the full path needs
All four, correlated
Yes
Yes
Yes
Yes
Three Blind Spots Attackers Count On
IAM and IDaaS
Who can log in
Agent Behaviour
No
Host Exposure
No
Identity Relationship
Partial
Proof of Exploitable
No
PAM
Vaulted privileged account
Agent Behaviour
No
Host Exposure
No
Identity Relationship
Partial
Proof of Exploitable
No
IGA
Access reviews on a cycle
Agent Behaviour
No
Host Exposure
No
Identity Relationship
Partial
Proof of Exploitable
No
Attack-path tool
How identities connect
Agent Behaviour
No
Host Exposure
Partial
Identity Relationship
Yes
Proof of Exploitable
No
Vulnerability management
Flaws on hosts
Agent Behaviour
No
Host Exposure
Yes
Identity Relationship
No
Proof of Exploitable
No
SIEM
Alert from written rules
Agent Behaviour
Partial
Host Exposure
No
Identity Relationship
No
Proof of Exploitable
No
What the full path needs
All four, correlated
Agent Behaviour
Yes
Host Exposure
Yes
Identity Relationship
yes
Proof of Exploitable
Yes
The Handoff Problem
| Team | What they see | What they miss |
|---|---|---|
Vulnerability management | Unpatched hosts | That a host sits few steps from a domain controller |
Cloud security | The entitlements they own | The identity an agent uses to reach them |
AppSec and DevOps | Code and integrations | Whether the account behind them is over-scoped |
IAM | Access on paper | Access being used right now |
SecOps | Alerts from written rules | Agent activity no rule was written for |
CISO | Reports from every team | One inventory of which agents exist and what they can reach |
Vulnerability management
What they see
Unpatched hosts
What they miss
That a host sits few steps from a domain controller
Cloud security
What they see
The entitlements they own
What they miss
The identity an agent uses to reach them
AppSec and DevOps
What they see
Code and integrations
What they miss
Whether the account behind them is over-scoped
IAM
What they see
Access on paper
What they miss
Access being used right now
SecOps
What they see
Alerts from written rules
What they miss
Agent activity no rule was written for
CISO
What they see
Reports from every team
What they miss
One inventory of which agents exist and what they can reach
Every team is doing its job. Put their answers side by side and they still don't add up to the only question that matters: what can this identity reach, and through whom?
Why the board should care
Gartner predicts that through 2027, manual AI compliance processes will expose 75% of regulated organizations to fines of more than 5% of global revenue.[4]
PART 2 · THE AI ACCELERATOR
AI Agents Change the Rules of Identity Governance
A service account raises one question: what is this system? An AI agent raises a harder one: why is it acting, right now, and on whose behalf?
An agent picks its own tools and chains actions across systems using whatever credentials it was given. Its access cannot be granted once and forgotten. Security leaders know it: 49% of security decision-makers in Forrester's 2026 survey name agentic AI as a concern.[5]
Agents make all three questions harder. They are often created outside security's view, and shadow agents are now ranked among top threats for 2026.[6] They rarely have an identity of their own, so they borrow service accounts, API keys and OAuth tokens, along with every excess privilege those carry. And through their tools, one agent can reach identity providers, cloud, SaaS and code at once.
How Agent Access Quietly Spirals
One agent can carry multiple identities at once, for instance: its own credential, the access of whoever invoked it, the rights of whoever can edit it, and the identities of the agents it talks to. Together, they create risks that are easy to miss:
Built for one task, capable of far more.
Everyone using the agent acts with its creator’s access.
Credentials sitting in config files with no rotation or expiry.
Unregistered, unowned and invisible to security.
Shared credentials make an agent’s actions look like a human’s.
PART 2 · THE AI ACCELERATOR
AI Agents Change the Rules of Identity Governance
A service account raises one question: what is this system? An AI agent raises a harder one: why is it acting, right now, and on whose behalf?
An agent picks its own tools and chains actions across systems using whatever credentials it was given. Its access cannot be granted once and forgotten. Security leaders know it: 49% of security decision-makers in Forrester's 2026 survey name agentic AI as a concern.5
Agents make all three questions harder. They are often created outside security's view, and shadow agents are now ranked among top threats for 2026.6 They rarely have an identity of their own, so they borrow service accounts, API keys and OAuth tokens, along with every excess privilege those carry. And through their tools, one agent can reach identity providers, cloud, SaaS and code at once.
How Agent Access Quietly Spirals
One agent can carry multiple identities at once, for instance: its own credential, the access of whoever invoked it, the rights of whoever can edit it, and the identities of the agents it talks to. Together, they create risks that are easy to miss:
Built for one task, capable of far more.
Everyone using the agent acts with its creator’s access.
Credentials sitting in config files with no rotation or expiry.
Unregistered, unowned and invisible to security.
Shared credentials make an agent’s actions look like a human’s.
Each of these widens what a single agent can reach. But the harder truth is that an agent doesn't need any of them to cause damage.
How a Least-Privileged Agent Still Opens a Breach
A reporting agent processes a document with hidden instructions and acts on them.
Its own permissions are tightly scoped, so it gains the attacker little.
But the action lands on an unpatched server. The attacker takes the machine and harvests credentials stored on it.
One of those accounts has a route into a privileged group. Nothing on paper connects it to the agent.
The takeaway
The agent was least-privileged; the blast radius was not. The risk sat in three places at once: the agent's behavior, the host it touched and the identities around it. Each is watched by different tools and owned by different teams, so no one saw the whole path.
So the question isn't how to lock down one agent. It's how to see, confirm, and break, the whole path.
PART 3 · THE PLAYBOOK
Five Best Practices for AI Agent Identity Risk Monitoring
The breach you just saw didn't need a single failure. It needed an unowned identity, a vulnerable host, a path nobody traced and a fix nobody could prove. Stopping it means changing the question security asks. The perimeter has moved from the network, to the login, to intent: is this identity allowed to do this specific thing, right now? That's a shift from access governance ("was access granted correctly?") to risk management ("what can this identity actually do, and what happens if it's misused?").
Five best practices make that shift practical, each one breaking a link in the chain you just saw.
| Best practice | What to do | Ask yourself |
|---|---|---|
1. Know every agent, and who owns it | Inventory every AI agent and the identities it runs on; name an owner | Could you list every AI agent with standing access today? |
2. Connect identity to exposure | Correlate agent identities with host and behavior data | Do you know which agent accounts can reach a newly vulnerable host? |
3. Prioritize by reach | Rank paths by the critical assets they reach | Can you trace an agent's access to a crown-jewel system? |
4. Prove before you act | Safely test top paths, re-test after fixes | How many "critical" findings could an attacker actually use? |
5. Govern at machine speed | Monitor agent access in real time and trigger fixes automatically, within approved guardrails. | How long does it take to revoke an agent's access? |
Know every agent, and who owns it
What to do
Inventory every AI agent and the identities it runs on; name an owner
Ask yourself
Could you list every AI agent with standing access today?
Connect identity to exposure
What to do
Correlate agent identities with host and behavior data
Ask yourself
Do you know which agent accounts can reach a newly vulnerable host?
Prioritize by reach
What to do
Rank paths by the critical assets they reach
Ask yourself
Can you trace an agent's access to a crown-jewel system?
Prove before you act
What to do
Safely test top paths, re-test after fixes
Ask yourself
How many "critical" findings could an attacker actually use?
Govern at machine speed
What to do
Monitor agent access in real time and trigger fixes automatically, within approved guardrails.
Ask yourself
How long does it take to revoke an agent's access?
PART 4 · PUTTING IT INTO PRACTICE
From Scattered Signals to One Governed Record
An AI agent isn't one thing. It's a stack, and every layer carries its own risk.
At the top of the stack sit the agent's identity and access and the certificates, keys and tokens it authenticates with. Beneath them are the MCP integrations that connect it to tools, its behavior at runtime, the container and image it ships in, and the host and OS it runs on. Today, each layer is watched by a different tool.
The Qualys Risk Operations Center (ROC) brings every layer into one view. It runs on Qualys Enterprise TruRisk Management (ETM): it unifies risk data from Qualys and third-party tools, scores it with TruRisk, validates exploitability with TruConfirm, quantifies business impact in dollars, and drives remediation through TruRisk Eliminate.
ETM Identity covers the identity layers, TotalAI the agent layers and Qualys sensors the infrastructure, and ETM brings them together to score, prioritize, prove and fix.
Viewed together, those layers surface the risks that matter: over-privileged entitlements, expiring certificates and weak cryptography, identity attack paths, shadow AI, model security posture and missing guardrails.
How the Five Best Practices Map to the ROC
| Best practice | How Qualys delivers it | What your team gets |
|---|---|---|
1. Know every identity, and who owns it | TotalAI discovers agents, models and MCP servers; ETM Identity inventories human and machine identities across Active Directory, Entra ID, Okta and local hosts | One inventory of every human, machine and AI identity, each with an owner |
2. Connect identity to exposure | ETM joins identity, runtime and host findings from Qualys and third-party tools into one record | A weak identity on an exposed host shows up as one problem, not three alerts |
3. Prioritize by reach | ETM Identity attack paths and Identity TruRisk™, re-ranked with TruLens threat context | Paths ranked by what they reach and how likely they are to be targeted now |
4. Prove before you act | TruConfirm™ to confirm credentials work, check effective access against live controls and name the control that blocks a path | Every path labeled validated, confirmed or blocked, with time-stamped evidence |
5. Govern at machine speed | TruRisk™ Eliminate patches, mitigates or isolates, and routes fixes through ITSM; ETM re-scores the risk | Fixes that are logged, reversible and proven by a lower TruRisk™ score |
Know every identity, and who owns it
How Qualys delivers it
TotalAI discovers agents, models and MCP servers; ETM Identity inventories human and machine identities across Active Directory, Entra ID, Okta and local hosts
What your team gets
One inventory of every human, machine and AI identity, each with an owner
Connect identity to exposure
How Qualys delivers it
ETM joins identity, runtime and host findings from Qualys and third-party tools into one record
What your team gets
A weak identity on an exposed host shows up as one problem, not three alerts
Prioritize by reach
How Qualys delivers it
ETM Identity attack paths and Identity TruRisk™, re-ranked with TruLens threat context
What your team gets
Paths ranked by what they reach and how likely they are to be targeted now
Prove before you act
How Qualys delivers it
TruConfirm™ to confirm credentials work, check effective access against live controls and name the control that blocks a path
What your team gets
Every path labeled validated, confirmed or blocked, with time-stamped evidence
Govern at machine speed
How Qualys delivers it
TruRisk™ Eliminate patches, mitigates or isolates, and routes fixes through ITSM; ETM re-scores the risk
What your team gets
Fixes that are logged, reversible and proven by a lower TruRisk™ score
PART 5 · FROM FINDINGS TO EVIDENCE
From Possible Risk to Proven Risk
An attack-path map is a list of suspects, not a verdict.
Less than 1% of critical vulnerabilities are truly exploitable. Two paths can carry the same score, yet one is stopped by an EDR policy while the other walks straight through. Qualys is extending TruConfirm™ to identity findings to tell them apart with evidence.
Safely checks whether techniques such as Kerberoasting or shadow-credential abuse would work in your environment, then cleans up.
Your team chooses which checks run and skips anything too intrusive for production.
Proven paths go straight to remediation, then get re-tested to confirm they are closed.
The payoff
Thousands of identity findings shrink to the short list an attacker could use today, and "fixed" becomes something you can prove.
PART 6 · MOVING WITH THE SPEED OF ATTACKS TODAY
Govern Identity at Machine Speed
When vulnerabilities surface faster than they can be fixed, every unpatched host is one borrowed identity away from a breach.
Frontier AI models can now find and chain vulnerabilities faster than any team can patch them. The bottleneck has moved from finding flaws to fixing them. When a host cannot be patched today, identity is the control you can change today: remove the permission, shrink the account's reach and block the path.
The faster you can make those changes, the smaller the attacker’s window, and that speed is what Agent Grant is built for.
Agent Grant: An Agent for Agent Governance
Agent Grant, the agentic AI analyst inside Qualys ETM Identity, governs AI identities. It works alongside your team in plain language, at the level of autonomy you choose, and waits for approval before changing anything.
Turns a plain-language request into a step-by-step remediation plan.
Weighs exploitability, privilege scope, business criticality and compliance for every identity an agent can use.
Uses TruConfirm™ to confirm a weakness is real before recommending a change.
Quarantines risky accounts, enforces MFA, removes toxic group memberships and starts remediation through TruRisk™ Eliminate, ServiceNow or Jira, with approvals and rollback.
Tracks the risk reduction from every fix, in a number leadership can report.
PART 7 · GETTING STARTED
Where Do You Stand? A Five-Step Quick-Start Checklist
Machine-speed governance can only act on what you can see. Before a fix can run in minutes, you need to know which agents exist, what they can reach and which paths are real.
The five steps below get you there. Work through them and you’ll know how quickly your team can answer the three questions this guide opened with: what acted, which identity did it use, and what could it reach?
Count your AI agents and the identities they run on. Name an owner for each.
Pick one crown-jewel system and trace every identity that can reach it.
Find long-lived tokens and shared or maker credentials, and set expiry.
Test your top five “critical” identity paths. Fix the ones that are real.
Time how long it takes to revoke an agent’s access, then set a target to reduce it.
Break the Attack Path Before Your AI Agents Walk It
Watch the session from ROCon Americas 2026 to see how the ROC extends to every identity and AI agent, including a live demo.
Sources