Human risk management assumes risk enters through a person. AI agents have identity without training. See the lifecycle that closes the gap, stage by stage.
Human risk management assumes the unit of risk is a person. That person has an identity, a role, and a training history. AI agents have the identity and neither of the others. Extending the programme means giving agents the lifecycle employees already get: onboarding, scoped permissions, ongoing review, and offboarding.
Human risk programmes rest on a stable assumption. Risk enters through a person you can identify, train, measure, and if necessary talk to.
AI breaks that in two directions at once. Employees now make a new class of decision, granting access and acting on unverified output rather than simply clicking or not clicking. Meanwhile a second population has appeared that takes actions under delegated authority and receives no training at all.
The temptation is to treat these as separate programmes. That is a mistake, because both resolve to the same question a human risk programme already asks: who can do what, and what happens when they get it wrong.
So the work is extension rather than replacement. The frameworks mostly hold. What breaks is the set of assumptions underneath them, which the rest of this post walks through. Related ground appears in why people remain the largest attack surface.
Figures here vary widely between sources. The table below uses only numbers traceable to named research, rather than to one vendor’s telemetry.
| Finding | Source |
|---|---|
| 45% of employees are regular AI users on corporate devices, up from 15% a year earlier | Verizon 2026 Data Breach Investigations Report |
| 67% of those users sign in with non-corporate accounts | Verizon 2026 Data Breach Investigations Report |
| 57% of surveyed employees use personal GenAI accounts for work, and a third admitted uploading sensitive information to unsanctioned tools | Gartner survey of 175 employees, May to November 2025 |
| 20% of organizations reported a breach involving shadow AI | IBM Cost of a Data Breach Report 2025 |
| 63% of breached organizations had no AI governance policy, and only 34% of those with one audit for unsanctioned use | IBM Cost of a Data Breach Report 2025 |
| Machine identities outnumber human employees by more than 80 to 1 in most enterprises | CyberArk |
For example, read the Gartner and Verizon rows together. One measures stated behaviour in a survey, the other measures observed behaviour on devices, and they agree on direction and rough scale.
Above all, the IBM pair is the one to act on. Most organizations never wrote the rule, and most that did never checked it, which is a governance gap rather than a technology gap.
Discover how Threatcop protects your workforce from modern cyber threats.
The CyberArk ratio is the most useful number in the table, and it rarely appears in human risk discussions.
Machine identities outnumber human employees by more than 80 to 1 in most enterprises. Gartner projected that 40% of enterprise applications would embed task-specific AI agents by 2026, and every one of those agents is an identity. It authenticates to databases. It sends email on behalf of employees.
That reframes the scope problem. A human risk programme covering 4,000 employees may be covering under 2% of the identities acting inside the organization.
None of those machine identities completed onboarding. Nor did any receive training. And when the project that created them ends, nobody revokes them, because nobody scheduled it. Identity exposure of this kind appears in insider risk that is misguided rather than malicious.
Three assumptions fail, and knowing which ones fail tells you what to rebuild.
Training changes behaviour. For people, repeated exposure builds judgement. No agent learns in that sense at all. Its behaviour changes only when someone changes its instructions, tools, or permissions, which makes configuration the equivalent of training.
Risk scores are per person. A vulnerability score describes an individual’s susceptibility over time. By contrast, an agent has no susceptibility that varies with mood, fatigue, or workload. Its risk is entirely a function of what it can reach and how autonomously it acts.
Accountability follows the actor. When an employee errs, the action traces to them and correction is possible. When an agent errs, responsibility spans the developer who built it, the administrator who set its permissions, and whoever authorised the deployment. Nobody has resolved that responsibility gap.
Consequently, the programme needs a parallel track for agents rather than an extended one, running the same lifecycle with different mechanics at each stage.
Organizations screen, train, and offboard humans. The table below applies the same stages to agents, which is the gap most commentary names and leaves open.
| Employee stage | Agent equivalent | What it means in practice |
|---|---|---|
| Screening | Provenance check | Where the model, framework, and any marketplace components came from, and who signed them |
| Job description | Scope definition | What the agent may do, in business terms, written before access is granted |
| Access provisioning | Scoped credentials | Its own identity, never a shared high-privilege account, with least agency applied |
| Onboarding | Supervised period | An initial window where consequential actions require approval and outputs are reviewed |
| Training | Configuration control | Versioned prompts and tool lists, changed through review rather than by editing production |
| Performance review | Behavioural monitoring | Deviation from expected patterns triggers alerts, since the agent will not report itself |
| Access review | Quarterly recertification | Someone confirms the tools and credentials are still needed |
| Offboarding | Decommission and revoke | Credentials revoked, standing grants removed, logs retained |
In practice, two rows do most of the work. Scope definition forces a decision before access exists, which is far cheaper than retrofitting permissions onto a running agent. And decommissioning is the stage almost everyone skips, leaving standing credentials attached to projects that ended months ago.
Meanwhile, agents are only the new part. The human side changed too, and awareness programmes have been slower to notice.
The highest-risk employee behaviour used to be clicking a link. It is now granting access. Consider what that involves. An employee approves an OAuth scope during setup. Another connects an assistant to a mailbox. A third pastes an API key into a config file. Each made a security decision with a longer tail than any click.
Similarly, a second behaviour matters nearly as much: acting on unverified AI output. When a model returns a confident answer, the risk is not that the model is wrong. It is that someone acts on it without checking, and the organization then treats the resulting action as a considered decision.
There is also a contagion effect worth naming. When employees see an agent granted broad access to sensitive systems, their sense of where the boundaries sit shifts. Permissiveness at the machine layer quietly licenses permissiveness at the human layer.
Threatcop’s TLMS addresses these as role-specific scenarios rather than one shared AI module. People approving scopes and people acting on outputs then practise the decisions they actually face. Programme design for this sits in training shaped by the decisions each role makes.
Budgets tell you what an organization actually believes about AI agent risk. Gartner’s fourth-quarter 2025 forecast put global information security spending at $244,200,000,000 for 2026, up 13.3% year on year.
Within that, analysis of the same forecast found enterprises spending roughly 17 times more on AI tools than on securing AI itself. However, the ratio is the argument, rather than the absolute figures.
Forrester went further in its 2026 predictions, published in October 2025. It forecast that an agentic AI deployment would cause a publicly disclosed data breach during the year, leading to dismissals. Senior analyst Paddy Harrington framed it as a cascade of failures rather than a single point of error.
Consequently, a cascade is precisely what the lifecycle table is designed to interrupt. Each stage is a place the chain could have been broken by someone asking an ordinary question.
Existing human risk metrics stay useful and stop being sufficient. Six additions cover the agent half.
Notably, the last one connects the two halves. Granting behaviour is observable and trainable in the same way click behaviour is, which is what makes it a human risk metric rather than an IT one. Measurement approaches sit in measuring behaviour through simulation.
The responsibility gap around AI agents gets raised often and resolved rarely. A workable position is worth stating.
An agent cannot hold accountability. It has no intent to question and no capacity to learn from correction in the way a person does. Treating it as a colleague who made a mistake is a category error.
Therefore accountability attaches to a named human owner at deployment, before anything goes wrong. That person owns the scope, the permissions, the review cadence, and the decommission date.
In short, this is not about blame. It ensures each agent has someone whose job includes noticing it. In every documented incident, the failure mode was an agent nobody watched doing something nobody authorised.
Ask two people in your organization how many AI agents are running, and compare the answers. The gap between them is the size of the problem, and it is almost always larger than either estimate.
Then pick the agents you can name and check one thing for each: does it have a human owner with a decommission date? Most will not. Yet that single field converts an agent from an untracked identity into something your existing risk programme can manage.
After that, extend the training to the decisions people actually make now, which are granting access and acting on output rather than spotting a bad link.
AI changes it in two directions. Employees face a new class of decision, granting access to tools and acting on unverified output, which carries longer consequences than clicking a link. Separately, AI agents act under delegated authority without onboarding, training, or offboarding. Extending the programme means running the same lifecycle for agents with different mechanics at each stage.
Yes, as a parallel track rather than an extension. Agents cannot be trained in the behavioural sense, and their risk depends entirely on what they can reach and how autonomously they act. Instead, apply employee lifecycle stages to agents. Provenance checks replace screening. Scope definition replaces the job description. Configuration control replaces training, and decommissioning replaces offboarding.
More than most can count. CyberArk reports machine identities outnumbering human employees by more than 80 to 1 in most enterprises. Gartner also projected that 40% of enterprise applications would embed task-specific AI agents by 2026. Every agent is an identity that authenticates to systems and can act on an employee’s behalf, so agent inventory is usually the first gap a programme finds.
Responsibility currently spans the developer who built the agent, the administrator who set its permissions, and whoever authorised the deployment, and the governance frameworks for resolving that are still developing. The practical answer is to assign a named human owner at deployment who owns the scope, permissions, review cadence, and decommission date.
Estimates vary by method. A Gartner survey of 175 employees between May and November 2025 found 57% using personal GenAI accounts for work, with a third admitting they uploaded sensitive information to unsanctioned tools. Verizon’s 2026 Data Breach Investigations Report found 45% of employees are regular AI users on corporate devices and 67% sign in with non-corporate accounts.
Adhish Chakma is a Senior Product Manager at Kratikal, where he leads product initiatives focused on cybersecurity and AI-powered solutions. With experience in product management and cybersecurity, he works on developing practical technologies that address evolving security challenges. His areas of interest include People Security Management, cybersecurity awareness, AI-driven security, email security, and human-layer risk. He is passionate about building security products that make organizations more resilient against emerging cyber threats.
Personal AI agents reach work devices without procurement or review. See what OpenClaw exposed, how to find agents already...
Mindfulness predicts phishing detection better than knowledge. See why relaxed people click more, why warnings decay after two exposures,...
Implement AI agents securely by scoping tools, isolating identity, and keeping authorization outside the model. Permissions decide the damage,...