Omada Survey Finds Identity Governance Gaps as Agentic AI Adoption Expands
Summary
Omada’s survey of 577 U.S. enterprise identity and security professionals finds gaps in risk reporting, integration, and AI-agent controls. Some 85% report using or piloting agentic AI, while governance practices remain uneven.
Key points
- Omada commissioned BCKL Group to survey 577 professionals at U.S. enterprises with 1,000–10,000 employees; findings reflect self-reported practices and perceptions.
- While 74% report provisioning and deprovisioning timeliness to executives, leading risk indicators such as privileged access coverage and orphaned accounts are tracked less consistently.
- Some 95% report at least some Zero Trust adoption, but inconsistent APIs, event standards, and integration hinder unified identity visibility.
- AI-agent credential practices vary: 48% of executives report rotating credentials, while some respondents describe reliance on static credentials or shared accounts.
- Non-human identities outnumber humans in most surveyed organizations, with responsibility spread across security, IAM, development, and operations teams.
- Some 85% report using or piloting agentic AI, with security the most frequently cited deployment concern.
- The report calls for clearer identity ownership, integrated reporting, unique agent identities, and stronger credential hygiene as automated access expands.
Article Details
- Publisher
- Omada
- Report Period
- 2026
- Scope
- Survey of identity governance practices, identity threats, Zero Trust, non-human identities, and GenAI and agentic AI adoption at U.S. enterprises.
- Sample Size
- 577 identity, access management, and cybersecurity professionals at U.S.-based enterprises with 1,000–10,000 employees.
- Key Statistics
- The survey included 577 respondents.
- 95% of organizations reported some level of Zero Trust adoption.
- 85% of organizations were already using or piloting agentic AI.
- More than 80% of respondents reported concern about each major identity threat category assessed.
- 74% of organizations regularly reported provisioning and deprovisioning timeliness to executives.
- Recommendations
- Improve executive visibility into leading identity-risk indicators, including privileged access coverage, orphaned or unused accounts, and time to revoke access after a role change or departure.
- Establish clear ownership and accountability for non-human identities.
- Use unique identities and strong credential practices, such as rotating, short-lived credentials, for AI agents.
- Improve integration and interoperability across identity and security systems to support unified reporting and visibility.