Survey Finds AI Identity Access Outpacing Enterprise Governance
Summary
Saviynt’s 2026 report, based on a survey of 235 security and IT leaders, finds widespread AI identity access but limited visibility, monitoring, and governance. It recommends identity inventories, least privilege, and continuous oversight.
Key points
- The report says 71% of surveyed organizations have AI tools accessing core systems, while 16% govern that access effectively.
- Seventy-five percent of respondents said they had discovered unsanctioned GenAI tools in their environments.
- Ninety-two percent reported lacking full visibility into AI identities, and 95% doubted they could detect or contain misuse.
- Eighty-six percent said they lack or do not enforce access policies for AI identities; only 25% use AI-specific monitoring or controls.
- Forty-seven percent said they had observed unintended or unauthorized AI-agent behavior, and about one-third reported a security incident or contained near-miss in the past year.
- The report recommends discovering and classifying AI identities, limiting privileges, and applying lifecycle governance and continuous monitoring.
- Findings are based on self-reported responses from 235 senior security and IT leaders at large enterprises in the United States and United Kingdom.
Article Details
- Publisher
- Cybersecurity Insiders
- Report Period
- 2026 (Version 1.1 dated January 2026)
- Scope
- Survey of enterprise leaders on AI identity access, visibility, governance, and security risk.
- Sample Size
- 235 CISOs, CIOs, and senior security leaders at enterprises with 5,000+ employees in the United States and United Kingdom.
- Key Statistics
- 92% of surveyed organizations lack full visibility into their AI identities.
- 75% of CISOs reported discovering unsanctioned GenAI tools in their environments.
- 71% of organizations said AI tools have access to core systems.
- 33% reported a security incident or contained near-miss involving AI in the past 12 months.
- The survey reports a margin of error of ±6.4% at a 95% confidence level.
- Recommendations
- Discover, identify, and classify AI identities across applications, distinguishing them from human users and other identity types.
- Continuously monitor AI identities and assess their access, privileges, and behavior.
- Apply lifecycle governance and least-privilege controls, including provisioning, access reviews, and deprovisioning.
- Review AI tools for access scope, embedded credentials, and data exposure before onboarding them into governance controls.
- Use time-bound privilege elevation and automatically revoke access when defined risk thresholds are breached.