AI agents are gaining access to business applications, sensitive data and infrastructure, forcing security teams to reconsider access controls designed primarily for employees and managed devices.
New research from the IDC InfoBrief AI Drives New Access Control Requirements, sponsored by Portnox, found that three forms of AI agent access ranked among enterprise buyers’ leading access control priorities for 2026. Agent-to-agent access received 18% of responses, followed by agent-to-resource access at 16% and agent-to-device access at 15%.
The findings come from IDC’s March 2026 Zero-Trust Segmentation Buyer Adoption Survey of 400 respondents. User access to resources and device access to resources each received 15%.
AI also featured prominently in organizations’ zero-trust plans. “AI usage and access” ranked first among zero-trust priorities at 14%, followed by “AI infrastructure” at 13%. Users and identities, as well as data, each received 11%.
The challenge extends beyond setting access policies. AI agents can authenticate to applications, retrieve information and take actions without continuous human supervision. When a security tool identifies risky behavior, a response process that depends on an employee reviewing an alert and opening a ticket can leave the agent connected to business systems.
“AI agents now have access to sensitive business systems, and companies need clear limits on what they can do,” said Garrett Gross, Field CISO at Portnox. “Organizations need to know how quickly they can cut off risky access. If that still depends on someone reviewing an alert and opening a ticket, an AI agent can keep working while the security team catches up. Every minute spent waiting is another minute that an agent can reach data or systems where it can do damage.”
The InfoBrief recommends that organizations evaluate security performance based on the time between detecting risk and enforcing a response. As the report states, “New KPIs should track how quickly a detected risk becomes an enforced control, not just how many risks surface.”
Security and compliance requirements are already affecting how organizations deploy AI. In IDC’s 2026 Future Enterprise Resiliency and Spending Survey, 41.6% of respondents said meeting security and compliance requirements was an important factor in deploying AI extensively. Security and compliance restrictions also ranked as the second most common reason organizations limited deployment. That survey included 1,009 respondents.
Network access control, or NAC, ranked as the second most important technology for providing comprehensive visibility and contextual information. Among respondents, 95% described their NAC as effective or very effective at increasing the granularity of segmentation policies.
“You can’t enforce access you can’t see,” said Gross. “IDC study’s data puts NAC second for the visibility and context security teams need, and that visibility is what lets you restrict risky access the moment it’s flagged.”
Cloud complexity adds another layer to the problem. About 60% of respondents manage at least six cloud environments, while approximately 38% manage 10 or more. Security teams must apply access rules consistently across these environments as AI agents move between applications, data and infrastructure.
The findings suggest that organizations need to know which AI agents are connecting, what resources they can reach and whether their access still meets policy. They also need an enforcement process that can restrict or revoke access as soon as an agent’s behavior, device posture or risk level changes.
Join our LinkedIn group Information Security Community!
