SpyCloud: 95% of Companies Think They Monitor AI Agents, Only 36% Do

The 2026 SpyCloud Identity Threat Report surveyed 750 security leaders: 95% believe they have visibility into AI and machine-identity exposure, but only 36% actually monitor them. Non-human identity misuse was the most common identity-based security event at 42%.

• 95% of firms believe they see AI identities; only 36% actually monitor them
• Non-human identity misuse is the top identity event at 42%, ahead of ransomware (39%)
• 91% run AI agents with access to internal systems; 56% have formal governance
• 31% cite compromised non-human identities as the top initial access vector