What’s not working and
what’s at stake

Security and risk organizations face a wide array of challenges as they
modernize defense strategies for the AI era. Changing dynamics impacting risk
and security strategies include:

An invisible AI workforce that answers to no one.

An invisible workforce is emerging as AI agents are spun up across third-party tools, platforms, and disparate business units without central oversight. Provisioning is programmatic, and agents are rarely deprovisioned when work is complete. Agents execute decisions, access systems, and accumulate permissions at machine speed without the same fixed identity lifecycle applied to human employees.

The rise of a broad class of non-human identities, including service accounts, API keys, bots, and machine credentials, compounds the problem. These entities fall off the radar of legacy identity tools, leading to a swarm of ungoverned identities, dormant accounts, and permissions creep.

Without clear accounting for what agents are in play or what sensitive data is at risk, agents that spring to life as productivity assets can quickly become enterprise liabilities. These authorized, active, and unmonitored agents are ripe for potential data exposure, IP leaks, or compliance violations.

"Organizations that can't see where AI is being used, what data it's touching, or who authorized it aren't just exposed, they're unable to scale responsibly,” says Bryce Schroeder, Vice President Customer Security and Trust at ServiceNow. “Security and risk leaders need real-time inventory of AI assets mapped directly to business services, continuous risk scoring, and policy enforcement that acts on what it finds — not just reports on it. Governance isn't a foundation you declare; it's one you demonstrate through discovery, control, and auditability."

Point solutions cloud visibility.

Dozens of endpoint, identity, vulnerability scanning, and Governance Risk Compliance (GRC) solutions are deployed across the enterprise but rarely operate in a cohesive way. Sensitive data flows through prompts, integrations, and AI workflows that traditional protection tools were never designed to recognize. One misconfigured integration quietly exposes dozens of systems to the whims of a connected agent when no one is watching and can rein it in. Security and risk teams often end up flying blind because data remains buried in disconnected tools without a common lexicon or shared understanding.

Most security tools stop at the IT boundary.

Years of investment in security tools hardened the perimeter — endpoints, detection, and edge controls — but the estate has expanded far beyond what those tools were built to see. OT devices, medical equipment, industrial control systems, and physical infrastructure are active participants in the mix, operating out of view of most identity systems and inventory frameworks. A breach that starts with an unmanaged device moves quietly following paths that haven’t been mapped. Endpoint alerts aren’t triggered and they don’t surface in the identity record or vulnerability scanner. That leaves organizations adept at governing human credentials still highly vulnerable.

Fragmented systems impede work.

Security teams are drowning in signals, but there’s no real guidance on where to focus or how to determine what problem has the widest impact. The fragmented tool portfolio leaves teams dependent on manual processes to stitch together data from disparate systems, a practice that is highly ineffective against an active threat landscape. Without a cohesive workflow that automates and executes tasks, it’s hard to connect the dots from detection to prioritization all the way through remediation and proof of controls.

There’s no clear cross-process ownership that ensures proper resolution once a problem is detected and specific remediation chosen.
As identities explode across humans, machines, and AI agents, the delta between workflows that detect and act only widens.

“The industry is drowning in signals and starving for orchestration,” says Diana David, Futures Director for ServiceNow. “The problem was never
a shortage of data; it’s the absence of a governed workflow. Without that connective tissue, every new tool just adds noise to an already overwhelmed security operations center.”

Threats are moving at lightning speed.

Off-the-shelf AI has created opportunity for anyone to launch sophisticated cyberattacks, which are coming fast and furiously.
Fragmented systems make it difficult to triage alerts at scale, leaving teams burnt out and perpetually behind.

The regulatory landscape is intensifying.

Regulatory frameworks are multiplying across every region with real penalties and business risks. For example, the EU AI Act, which expands GDPR enhancement, is changing the landscape overseas; at the same time, in the United States, California and Colorado are leading the way with laws imposing safety and security frameworks on AI systems. There are dozens of other AI and data regulations in the works, many surfacing each year.

Organizations that can't see where AI is being used, what data it's touching, or who authorized it aren't just exposed, they're unable to scale responsibly.

Bryce Schroeder,
Vice President Customer Security and Trust, ServiceNow