SailPoint warns of 40-to-1 gap in AI agent security

SailPoint says 79% of enterprises are running AI agents in production, but its latest survey found only 2% have identity security tools designed specifically to govern them.

That points to a 40-to-1 gap between AI agent adoption and the controls used to manage access and oversight.

The identity security company also used the announcement to unveil product updates across its cloud and on-premises software, including new Human Fabric features, IdentityIQ 9.0 and tools aimed at governing human, machine and AI agent identities on one platform.

The survey covered 340 senior identity, IT, cybersecurity and risk leaders globally and assessed organisations against a five-tier maturity model. The results suggest companies are far less prepared to manage non-human and agent identities than traditional employee accounts.

More than half of respondents, 54%, were placed in the lowest maturity tier for agent identities, compared with 23% for human identities. AI agents now account for 22% of all non-human accounts, while 85% of organisations still rely on legacy identity tools not designed for agentic identities.

Another gap emerged between perception and operations. While 80% of leaders believe the shortfall in their tooling is moderate or smaller, only 15% can provision non-human access in real time.

Regulatory readiness also appeared uneven. While 57% said they were confident of meeting regulatory requirements, only 43% felt prepared to produce verifiable evidence in an AI-related audit.

Operational strain

The report suggests many companies are still grappling with basic visibility and control issues before they can attempt more advanced oversight of autonomous systems. Credential lifecycle management, shadow AI discovery and real-time monitoring were identified as major operational hurdles.

SailPoint argued that organisations with more mature non-human identity programmes are already seeing business benefits. Among those that had invested in securing non-human identities, 62% reported measurable productivity gains and 46% said they had deployed AI more safely and quickly.

Wendy Wu, Chief Marketing Officer at SailPoint, said: "Compressing a five-year maturity curve into a single year presents a massive operational challenge, starting with a fundamental awareness gap. Many organizations don't yet realize that they do not have the right tools purpose-built for the scale and velocity of agent and non-human identity security. You cannot bridge this gap by asking human-speed tools to work faster; security must be built for machine speed from the ground up, with discovery, ownership, and access decisions happening in real time rather than on a quarterly review cycle. Enterprises waiting for their agent programs to mature the way their human programs did are going to find out the hard way that they don't have five years."

The company tied those findings to a broader product push around what it calls autonomous identity security. The new releases include Autonomous Agents, intended to monitor runtime actions, intervene when threats are detected and adjust privileges without shutting down approved automated processes.

Matt Mills, President at SailPoint, said: "Autonomous agents are no longer just experimental copilots; they are becoming the primary execution layer of modern enterprises. Enterprises cannot afford to slow down AI innovation out of fear, nor can they afford ungoverned access chaos. Moving beyond Zero Trust to Autonomous Identity allows organizations to master the converged human-plus-AI workforce, eliminate invisible risk, and innovate with complete confidence."

Chandra Gnanasambandam, EVP of Product and Chief Technology Officer at SailPoint, said: "The idea that a security admin is going to review and approve access for a group of autonomous agents making 10,000 tool calls a second isn't just outdated-it's a fantasy. The only way to govern autonomous machines is with autonomous machine defense. We've built Autonomous Agents so enterprises can stop the threat, save the good agents, and bring human and non-human identity into real-time. In a near-AGI world, standing privilege is dead."

Platform updates

Alongside the agent-focused software, SailPoint announced updates to its Human Fabric cloud product and the release of IdentityIQ 9.0 for on-premises customers. The Human Fabric changes include a rebuilt certification engine for large-scale access reviews, a separation-of-duties control that evaluates conflicts at the point of request, and a conversational access request tool that lets users ask for access in natural language through chat systems.

IdentityIQ 9.0 is aimed at organisations with data residency, regulatory or custom deployment requirements. The release includes a modernised technical foundation, changes to access governance and an automated upgrade tool intended to reduce the manual work involved in on-premises updates.

Gnanasambandam said the company was trying to address both cloud expansion and support for longstanding on-premises users. "Most vendors ask their customers to choose between a growth story or a stewardship story, but the reality of the modern enterprise is not that simple. Today, we are delivering on both fronts. We are advancing the frontier of cloud identity security with Human Fabric while also demonstrating our commitment to the customers who rely on IdentityIQ for identity security. This is one modernization effort on two fronts, ensuring every customer has a path forward without compromise."

The wider platform changes also include tools for discovering shadow AI, mapping AI agent activity, producing audit evidence and applying just-in-time access controls for people, service accounts and AI agents. SailPoint said less than 1% of organisations in its survey had reached the top maturity tier in its model, underlining how early the market remains in governing non-human and autonomous identities.