Nearly 70% of Companies Lack Control Over AI Agent Privileges, PAM Survey Finds

A recent survey conducted by AM Media among viewers and participants of the webinar 'How to Choose the Best PAM in 2026' shows that 68% of organizations fail to fully control privileges assigned to AI agents and automated services. Another 67% report insufficient oversight of API keys, tokens, and secrets, while 63% cite gaps in managing CI/CD and DevOps tool access. Traditional human administrator accounts are better protected at 34%, highlighting a shift in risk toward machine identities. Experts from NGR Softlab and Solar Group emphasize that service accounts often interact with multiple systems and require broad rights, making their compromise far more damaging than individual user breaches. JumpServer PAM CEO Denis Morozov noted that AI integration into PAM platforms could help map complex permission matrices and quantify risks for security teams. Participants also prioritized usability (72%) and ease of deployment (63%) when selecting PAM solutions over cost considerations.

AntiMalwareTranslated from Russian

Read at source

A new survey highlights a critical gap in Privileged Access Management (PAM) practices: organizations are struggling to secure the growing number of machine identities created by AI agents, automated services, and cloud infrastructure.

Just a few years ago, privileged access primarily referred to human system administrators receiving root or Administrator rights. Today, however, non-human entities such as programs, services, and AI agents routinely hold equivalent or greater privileges. These machine identities can deploy applications to production, access databases, or create and delete virtual machines through CI/CD pipelines, API integrations, and cloud roles.

According to the AM Media poll, privileges of AI agents and automated services remain outside full control in 68% of cases. API keys, tokens, and secrets follow closely at 67%, while CI/CD and DevOps tool access accounts for 63%. Cloud roles reached 52%. In contrast, human system administrator accounts sit at 34% and service accounts at 26%.

Dmitry Simak, Product Manager for PAM Infrascope at NGR Softlab, explained that machine accounts frequently interact with multiple systems simultaneously and are therefore granted wide privileges. Their compromise can therefore grant attackers access to every connected system rather than a single target.

Ruslan Sharifulin of Safeinspect at Solar Group stressed that humans cannot respond to AI-driven threats in milliseconds. The primary task of modern PAM is therefore to place strict boundaries around non-human entities and enforce least-privilege principles.

Survey respondents indicated that usability for administrators and end users (72%) and simplicity of implementation (63%) are the top factors when choosing a PAM solution. Only 41% cited price as a primary concern.

Denis Morozov, CEO of JumpServer PAM, suggested that integrating AI into PAM platforms could analyze complex permission matrices, calculate risk scores, and present clear recommendations to security teams. Participants concluded that while AI agents introduce new threats, PAM remains essential and must evolve to cover machine identities.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in AI Security

Logical Argument Claims Full Alignment of Superintelligent AGI Is Fundamentally Impossible
Claude Account Bans Linked to IP Reputation, Device Environment and Payment Channels, But No Confirmed Formula
Local LLMs in AppSec: What Open Tools and Models Can Handle in Application Security