Louisville, Colo. – October 07, 2026 -- Ninety-two percent of organizations reported at least one AI-related incident or exposure in the past 12 months, according to a new JumpCloud study of 250 IT leaders in the U.S. and U.K. titled "Enterprise AI Access Is Outpacing Control." More than half of organizations now deploy AI agents capable of changing systems, permissions, or files, yet 59% of those using such agents do not apply the same governance rules used for human employees.
Identity integration lags as AI agents gain system access
Only 41% of organizations using AI agents have fully folded those agents into the identity and access management (IAM) policies governing human users, the study found. The remaining 59% operate without full integration, leaving a structural gap between how human and machine identities are controlled.
72% cannot prove what AI agents actually accessed
JumpCloud's research identifies a "Proof Gap": 72% of organizations say there is a considerable gap between what AI is permitted to access and what they can verify it actually accessed. More than one-third (36%) investigated an AI-related concern but could not determine what the AI had accessed, undermining incident response and compliance reporting.
Platform choice affects AI auditability scores
Auditability varies by workplace software platform. Just 11% of organizations primarily using Google Workspace fall into the lowest auditability tier, compared with 21% of those primarily on Microsoft 365, according to the report.
JumpCloud proposes lifecycle framework for agent governance
"AI agents are quickly becoming another class of identity in the enterprise. They can access sensitive systems, change records, trigger workflows, and act on behalf of people, but many organizations still aren't governing them with the same rigor they apply to human users," said Joel Rennich, senior vice president of advanced technologies and innovation at JumpCloud. The report outlines an Agentic IAM Lifecycle framework intended to help IT teams discover, register, manage, and govern AI agents alongside human employees, assigning owners and tracking agent actions from deployment through retirement.