The Agent You Didn’t Approve: Rethinking Identity Governance for AI Agents

This July, an autonomous AI agent broke out of its own lab environment and spent days inside another company’s systems – the agent’s operator did not realise until well after the victim organisation already had.

Incidents like this expose a structural gap: most organisations govern agent access before it acts, then watch for misbehaviour separately once it does. Fewer than a quarter of organisations have a formally adopted policy for creating or removing the non-human identities assigned to AI agents, according to a Cloud Security Alliance survey. Netwrix’s 2026 Data and Identity Security Report links that gap to real risk: a 43% breach rate among organisations where AI had significantly expanded the number of identities needing access, against 11% where it had not.

Join Dirk Schrader, resident CISO (EMEA) and VP of Security Research at Netwrix, to explore:

• Bringing access governance and behavioural monitoring together into a single motion
• Identifying the AI agent identities already running in your environment, including the ones never explicitly approved
• What posture assessment and identity inventory can achieve today
• What agentic behavioural detection cannot yet do
• A realistic read on where cloud identity providers such as Microsoft Entra ID fit into agent governance right now.