Most Organizations Now Use AI Agents for Sensitive Security Tasks

The Semperis study reports that most organizations are deploying or plan to deploy AI agents with access to sensitive identity resources, creating risks from abandoned, over‑permissioned, or shadow non‑human identities that attackers could hijack; many organizations lack formal governance and recovery readiness. The report recommends treating agents as NHIs, enforcing least‑privilege and just‑in‑time access, segregating agent/human trust boundaries, deploying UEBA to detect suspicious agent behavior, and ensuring rapid identity-system recovery.