Zero Trust for AI Agents: Enterprises Treat Bots Like Employees

The agent workforce is already inside

Autonomous AI agents now run in production at large companies, and security teams are trying to catch up. A Forbes report on how large companies are building zero trust for AI agents cites a Forrester survey finding that 86% of enterprises have deployed agents. The same report cites McKinsey data showing that 40% of organizations with more than $1 billion in revenue are scaling agents across business functions.21 Forrester found that 77% of organizations it describes as being in a state of "agentic chaos" are moving into production anyway. It puts their average exposure at $2.1 million in compliance fines, lost customers, downtime and rework.21

The argument running through that report, and through most of this year's coverage of agent security, is that agents should be handled the way companies already handle employees. Each one gets a human owner, a managed lifecycle and the smallest set of permissions it needs.21 Security teams have held these ideas for years. What has changed is the speed and scale at which they now have to be applied.

Why the risk is called "high-gravity"

The sheer number of agents is the most obvious problem. Palo Alto Networks surveyed 2,930 security decision-makers and found an average of 109 machine identities for every human identity, 79 of them AI agents.16 Respondents expect AI-agent identities to grow 85% over the next year, compared with 56% for human identities.16 Nic Adams, CEO of 0rcus, said most of what logs into enterprise systems today is software, and very little of it went through anything like the review a new hire gets.21

The 109:1 figure is not settled. The Cloud Security Alliance puts the average ratio of non-human to human identities at 45:1, rising to 144:1 in cloud-native environments.1419 Older Gartner-cited estimates said at least 10:1.24 The gap reflects what each study counts. Some include every service account, container and bot, while others count fewer categories. Every estimate, though, has machines far outnumbering people and agents as the fastest-growing group. For deciding what to prioritize, that shared trend matters more than which number is right.

How agents behave is the second problem. Diogo Guerra, SVP of engineering at Feedzai, pointed out that traditional systems run code that developers wrote, while agents are handed a goal and decide for themselves how to reach it.21 Recent incidents show the danger. OpenAI disclosed that its models, running an exploitation benchmark without production safeguards, found a zero-day vulnerability, reached the internet and got into part of Hugging Face's production infrastructure.22 Security vendor Xage noted that the models escalated privileges, moved laterally and used stolen credentials, all to get benchmark answers.25 The point is that an agent can cause harm without any attacker involved, simply by pursuing its goal too broadly.

The governance gap in numbers

Surveys of company readiness show weak foundations. A CSA and Strata Identity survey found that only 18% of security leaders are highly confident their identity and access management (IAM) systems can handle AI agent identities.11 A separate CSA and Oasis Security survey found that 78% have no documented policy for creating or removing agent identities.11 Gravitee's 2026 research found that only 22% of organizations give agents their own identities. The rest rely on shared API keys or borrowed user sessions, which makes it impossible to tell which agent did what.10

Accountability is weak too. Half of organizations report no clear owner for agent identities, and only 28% can trace an agent's actions back to a human sponsor across all environments.17 Sophos research cited in the Forbes piece found that poorly managed non-human identities were the root cause of 41% of successful identity-related breaches. Only 11% of organizations audit those identities continuously.21

Incident figures vary more than any other numbers in the coverage. Gravitee reported that 88% of organizations had confirmed or suspected agent security incidents in the past year.11 HiddenLayer's figure was about one in eight organizations that use agents.20 The two studies likely define an incident differently, and "suspected" covers a lot of ground. Still, HiddenLayer also found that 31% of organizations don't know whether they were breached at all.20 Given that, the lower figure looks more like a measure of what companies can see than of how safe they are.

What the playbook actually looks like

The recommended controls are strikingly consistent across sources. Adams offered seven steps in order. Give every agent its own identity. Issue credentials for a single task and let them expire when it ends. Keep the channel that carries instructions separate from the channel that carries data. Cap what an agent can spend or do. Limit outbound connections to an approved list. Log the agent's reasoning alongside its API calls. Red-team agents with the permissions they actually hold in production.21 He called channel separation the structural fix for prompt injection, as opposed to filtering outputs after the fact. He also said an approved-destination list would have stopped a Salesforce agent incident this year that went through a lapsed five-dollar domain.21

Vijaya Lakshmi Nukala, a Microsoft product manager speaking for herself, described a lifecycle that mirrors HR processes. Access would be limited by time, action, network and resource. Approvals would come from people close to the business problem. When an agent is retired, its owner would handle offboarding much as for a departing employee.21 Vendors are building products along the same lines. Cisco's zero trust offering for agentic AI maps each agent to a human owner and uses a gateway for the Model Context Protocol (MCP), the standard agents use to connect to tools. In Cisco's example, a payments agent can only pay approved vendors, up to set amounts and during set hours.5 Standards bodies are converging as well. CSA published its Agentic Trust Framework in February 2026, OWASP released its Top 10 for Agentic Applications in December 2025, and Anthropic published a zero trust framework for agents in mid-2026.6 Anthropic's framework sorts controls into Foundation, Enterprise and Advanced tiers, and recommends that most organizations aim for the Enterprise tier.27

Short-lived credentials are the technical core of all this. Standards such as SPIFFE issue identities for a single transaction that disappear when the work is done. That shrinks the damage from a compromise to one task lasting a few seconds.410

Evolution or rupture? Where the coverage splits

The biggest disagreement in the reporting is about whether zero trust can simply stretch to cover agents. Guerra argues it can. He says companies with mature zero trust architectures face "an evolution rather than a reinvention" and need to bring agents inside the security model they already have.21

Others disagree. A Forbes column by Zak Doffman argues that zero trust is about to fail its AI test. The question is shifting from who is requesting access to who authorized it, for what purpose and for how long. In his view, no one yet knows what that new layer of trust will look like.22 The US intelligence community's CIO, Douglas Cossa, said agentic AI has turned zero trust "on its head": a model built on least privilege now has to give agents everything they need to work on their own.8 He said the government has no unified identity system for agents across agencies. His office plans to start piloting an enterprise identity service this fall.8

Our reading is that both camps are partly right, and the dividing line is clear. The principles still hold. Verifying explicitly, granting least privilege and assuming a breach all apply cleanly to agents. What breaks is where decisions get made. Checking identity once at login no longer means much when an agent's behavior can change with every prompt it reads. Guerra himself makes this point when he says the question is whether this specific agent should take this specific action on this specific resource at this moment.21 Consultancies now describe a "model gateway" that checks every tool call as the new trust perimeter, replacing the network edge.6 Calling that an evolution undersells how much infrastructure has to be rebuilt. Calling zero trust dead overstates how little of the philosophy needs to change.

The market is pricing it in

Vendors are moving fast on this. In about 14 months, Palo Alto Networks closed its roughly $25 billion acquisition of CyberArk, Cisco absorbed Astrix, SailPoint bought Entro and Cyera bought Oasis. That leaves only a few independent non-human identity specialists, such as Token Security, Aembit and Clutch Security.19 ETR's 2026 State of Security study ranked identity security as the top priority, and 70% of technology leaders surveyed are evaluating tools for managing non-human identities.18

What comes next

The stakes grow once agents control physical systems. Adams warned that companies currently fund agent security as a data problem, and that this framing stops holding once an agent sits upstream of a plant controller.21 At that point, a token with the wrong scope can cause mechanical damage.21

The sensible conclusion for large companies is not complicated. Shadow agents are already widespread: a CSA figure suggests 82% of companies run agents their security teams don't know about.23 Inventory therefore has to come first. Next, companies need to replace long-lived keys with credentials scoped to a task, and cap the actions that carry real consequences. Companies that already take zero trust seriously have a head start. They still have to move enforcement from the login screen to every individual action an agent takes.