Guest blog courtesy of JumpCloud.
AI is driving the biggest wave of technology spend in a decade. Gartner forecasts worldwide AI spending will grow 47% in 2026, reaching $2.59 trillion. Boards want productivity gains, business leaders want speed, and teams across every function are testing tools that automate work. But as investment accelerates, AI adoption is widening a governance gap faster than many organisations can close it.For partners and resellers, this is a critical moment. The winners will be the ones who help clients secure the next generation of the workforce (both human and non-human) so innovation can scale without losing control of sensitive data and accountability.This is where Zero Trust becomes critical. Continuous verification based on identity, context, and device trust helps organisations enforce policy consistently across environments.The shift is simple. Partners move to strategic guidance and become the team that makes autonomy safe and sustainable.
The workforce is changing
For years, identity and access decisions were built around a familiar model. Employees and contractors join, change roles, and leave. As such, security teams designed processes around that lifecycle.However, agentic AI changes the picture. Autonomous AI agents don’t behave like typical applications, and they do not map neatly to traditional user accounts. They can be created quickly, run continuously, access files and databases, and trigger actions across systems. What’s more, they act at machine speed and often touch corporate data along the way.Recent research highlights how quickly organisations are moving ahead of guardrails. Nearly half of organisations allow high-risk AI actions without human approval. More than half lack a centralised kill switch for AI agents.Even where organisations are moving fast, basic oversight is often missing. Only 41% have visibility or audit trails for agent activity, and just 17% assign dedicated accountability for AI agent security. Many organisations already operate with more machines than people, and advanced environments can scale to many times more non-human identities than human ones.These signals highlight that many organisations are deploying autonomy before they have decided who is responsible when an autonomous system accesses sensitive data.The governance gap is a business risk
Only 8% of organisations globally maintain a comprehensive AI governance framework. That points to a significant gap between AI adoption and the controls needed to manage it. When governance lags, the impact shows up quickly in security and compliance.Security and data exposure risks rise when over-privileged access becomes the default route to keep pilots moving. Audit readiness suffers when teams cannot answer basic questions about what happened, who authorised it and which identity carried it out. Over time, operational friction follows as security and risk leaders stop deployments that cannot be governed at scale.Many AI initiatives stall for this reason. It’s not because the tools fail. Instead, it’s because the organisation cannot prove the programme is safe and controllable.Identity and scaling AI safely
A practical way to frame the challenge is to treat AI governance as an extension of identity governance. It is about defining who, or what, can access what, under which conditions, with what oversight, and how access is monitored and revoked.In fact, IT leaders already recognise this. Industry research found that 85% of IT leaders agree that secure identity and access management is critical for scaling AI safely. This clearly highlights where budgets and urgency are converging. Identity is increasingly the control plane for sustainable AI adoption.For partners, the next wave of security consulting will include non-human identities and AI agents that need ownership, lifecycle governance, enforceable policy, and auditable behaviour.What an Agentic IAM approach needs to deliver
Clients need a workable model they can apply as AI agent use accelerates. An Agentic IAM approach should deliver a few core outcomes.- First, discovery and visibility. Clients need to know where agents exist, what they connect to and which data they can reach.
- Second, lifecycle governance. Agents should be created with clear ownership and decommissioned cleanly when they are no longer needed.
- Third, control and assurance. Access should be least privilege by default, with high-risk actions having human-in-the-loop controls, and activity should be monitored with strong audit trails. Organisations also need a fast way to pause agent activity when something goes wrong.
Why is this a channel opportunity?
This governance gap is an opportunity for partners who can help customers move from experimentation to controlled scale.There are three natural ways to package the work:- AI readiness audits and governance assessments can uncover immediate risk and prioritise remediation.
- Infrastructure and identity refresh cycles can modernise access controls and device posture to support a world with far more non-human identities than people.
- Managed services for non-human identity governance can create an ongoing relationship that stays relevant as the client’s AI footprint grows.
