The News
Frontegg, a venture-backed identity and access management (IAM) provider serving enterprise customers including Siemens, Cisco, and Datadog, has released new research through its Agen.co platform examining how organizations govern AI agents. The report, “The State of Autonomous Agent Governance,” draws on a survey of 300 U.S. CISOs and CSOs and surfaces a striking contradiction at the heart of enterprise AI security: three-quarters of security leaders claim high confidence in knowing how many AI agents are connected to their systems, yet half admitted to discovering an agent running in production this year with access it should never have had. The findings arrive as AI agent deployments accelerate across the enterprise, bringing with them a class of identity and authorization problems that traditional IAM frameworks were never designed to handle.
Analyst Take
The Confidence Gap Is the Story
The headline number from this survey is not the 40% of organizations running AI agents on an employee’s personal credentials, alarming as that is. The real finding is the gap between perceived control and actual exposure. Seventy-five percent of CISOs say they’re very confident in their agent inventory. Fifty percent found a rogue agent in production this year. Those two figures cannot both be true without a serious measurement problem. Security leaders are applying human-oriented mental models, where identity is relatively static, provisioning is deliberate, and access reviews happen on a known population, to an environment where agents spin up dynamically, inherit credentials opportunistically, and often persist well beyond their intended scope.
This is not primarily a tooling failure. It’s a governance architecture failure. The survey data on accountability makes this plain: security is held accountable for agent incidents at 48% of companies but owns the agents at only 23%. IT owns them at 41%. That split ownership, combined with the lack of per-action verification (only 18% verify an agent’s identity before each action), creates exactly the conditions under which incidents accumulate quietly until they don’t.
What the Credential Data Tells Developers
For engineering teams, the specific finding on shared and long-lived API keys deserves close attention. Organizations running agents on shared or long-lived API keys had a 60% incident rate, compared to 46% for those that don’t. A 14-percentage-point gap tied to a single, changeable practice is a clear architectural signal. Agents operating on long-lived credentials are indistinguishable from compromised human accounts in most SIEM and audit environments. They generate the same log patterns, inherit the same permissions, and are subject to the same lateral movement risk once a key is exposed.
The 40% figure on personal credential reuse is particularly instructive. When developers or IT staff spin up agents using their own API tokens, they’re effectively granting those agents the full permission scope of a human employee, including access to resources the agent has no business touching. This is the agentic equivalent of running production workloads as root. It works until it doesn’t, and the blast radius when it fails is proportional to the credential’s scope.
ECI Research’s Google GovTech Survey found that 26.0% of respondents cited “Securing machine-to-machine secrets management and API tokens” as their organization’s biggest hurdle when implementing a Zero Trust architecture at the application layer. That survey predates the current wave of production AI agent deployments, which means the problem Frontegg’s data describes is likely to show up with increasing severity in enterprise Zero Trust assessments over the next 12–18 months. Agents are, at their core, a new and fast-growing category of machine identity, and most organizations have not extended their Zero Trust thinking to cover them.
The Policy Response Is Real but Incomplete
The 84% figure on post-incident policy tightening, triggered by the AI lab agent breakouts this past summer, suggests that the security community is alert to the category risk. But reactive policy changes after high-visibility incidents are different from systematic governance. The survey’s finding that only 4.2% of organizations have AI agent governance policy currently under development (per ECI Research’s Google GovTech Survey data) points to an industry that is mostly improvising. Approved use cases under defined policies cover 45.6% of organizations surveyed in ECI Research’s data, but “approved use cases” is a far cry from the kind of continuous identity verification and least-privilege enforcement the Frontegg data suggests is actually needed.
For ITDMs, the business risk framing is straightforward. Security is on the hook for incidents that IT owns operationally, and agents are being deployed on credentials that were never designed for non-human actors. That’s a liability structure waiting to produce a significant breach. The question isn’t whether organizations should address agent identity governance; it’s whether they do so proactively through architectural investment or reactively after an incident forces the issue. Given that ECI Research’s Google GovTech Survey found 56.0% of respondents citing “Lack of shared security context between on-premises systems and cloud platforms” as the biggest barrier to a unified security posture, adding a fast-growing fleet of AI agents with opaque credentials into that already fragmented environment raises the stakes considerably.
Looking Ahead
The market Frontegg is targeting with Agen.co is real, early, and about to get crowded. Every major IAM vendor is working through how to extend identity lifecycle management to non-human workloads. Frontegg’s advantage could be speed and focus: building agent-native identity controls before the incumbents finish retrofitting their human-centric platforms. The 300-CISO survey is as much a market-positioning document as it is research, and Frontegg knows it. That doesn’t make the findings less accurate; it makes the timing deliberate.
Over the next 12–24 months, expect agent identity to become a formal procurement category. Compliance frameworks will catch up, FedRAMP boundaries will need to address machine-to-machine authorization at the agent layer, and enterprise security teams will be asked to produce evidence of agent access controls in the same way they currently produce evidence of privileged access management. Organizations that treat agent identity as a first-class infrastructure concern now, building per-action verification, short-lived credentials, and scoped permissions into their agent deployment pipelines, will be materially better positioned when that compliance pressure arrives than those that are still running agents on a developer’s personal API token.
Stay Ahead of Application Development Trends
Get weekly analyst insights, research notes, event coverage, and AppDevANGLE updates delivered directly to your inbox.
Subscribe for Weekly Insights
Join technology leaders, practitioners, and GTM teams following the trends shaping modern software delivery.
Looking for deeper research access?
Explore ECI Research reports, survey insights, and market analysis through the ECI Research Portal.
