Every AI Agent Is an Identity. Most Organizations Don't Treat Them That Way

Executive summary: The report warns that organizations are rapidly deploying AI agents with broad capabilities (database queries, workflow automation, code deployment, email/API calls, file access) without treating them as governed identities, creating insider-like risks such as data exfiltration, unauthorized transactions, and introduction of vulnerable or malicious code. It recommends treating agents as non-human identities with unique credentials, least-privilege access, time-bound tokens, immutable audit logs, MFA for high-risk actions, continuous behavior monitoring, and integration with identity providers and SIEMs to close the identity gap and meet emerging regulatory expectations.