- SailPoint's survey of 340 leaders finds 79% run AI agents, while only 2% use security purpose-built for them.
- Agent identity programs trail human ones: 54% sit at the lowest maturity stage for agents, versus 23% for people. Only 15% can prove their gap is small.
- Count your agents and their standing access, then ask your team to measure the gap. Treat the vendor survey as direction, not proof.
Most companies can say who their employees are and what each one can reach. Far fewer can say the same about the software that now acts for those employees. That is the gap at the centre of SailPoint's fifth annual Horizons of Identity Security report, a survey of 340 leaders worldwide.
The lesson here is that the risk is not only the AI agent. It is the mismatch between how fast agents act and how slowly the controls around them respond.
What the survey found
SailPoint reports that 79% of respondents run AI agents. Only 2% use security purpose-built for them. The rest rely on tools designed for people.
The report says non-human identities already outnumber the workforce they serve. A non-human identity is any account that belongs to software rather than a person. An AI agent that queries data and acts on it needs one.
Two timelines, one company
SailPoint sorts programs into maturity stages it calls Horizons. Horizon 1 means no formal program. Horizon 2 means manual, tool-assisted work.
For human staff, progress is real. Five years ago, 45% of organizations sat at Horizon 1. Today that figure is 23%.
For agents, the picture is reversed. The report puts 54% of organizations at Horizon 1 for agent identity security. Across the market, a combined 60% remain in Horizon 1 or 2.
The report also finds that 67% have mastered human access, while 24% have mastered it for agents. The Hacker News summarises this as a coverage gap, not a competence gap. Teams know how to do the work. They have not yet applied it to machines.
Why the human playbook breaks
Identity security decides who or what may reach which system. For people, the usual routine is a request, a manager's approval through a ticket, and a periodic review.
That routine suits a person who asks for access a few times a month. SailPoint says it cannot keep pace with machines executing thousands of actions per minute. By the time a ticket is approved, an agent may have acted many times.
The report points to a different approach: moving from static rules to zero standing privilege. In plain terms, access is granted only when needed and removed afterward, instead of left switched on. The report does not detail how respondents implement this.
An old comparison helps. A border post staffed for foot traffic works until the traffic becomes a motorway. Adding clerks does not fix it. The design has to change.
The confidence problem
The most telling figure may be about belief. SailPoint finds that 80% of respondents perceive only a minor tooling gap. Only 15% can prove it.
Another 49% say they balance speed and security equally. SailPoint argues that balance without the means to enforce it amounts to a stall. This is a vendor's reading. Still, the pattern fits the data: leaders feel covered, and few can show it.
A gap you cannot measure is a gap you cannot fund. Executives are likely to hear that all is well because nobody has counted.
How far to trust the numbers
SailPoint sells identity security, and its report is marketing as well as research. The material available here does not describe how the 340 respondents were chosen. Read the figures as one vendor's survey, not a census of all companies.
The direction is still useful. Criteo's Jérôme Robin, quoted in the report, says the aim is to make AI adoption "safe enough to scale."
Questions to put to your team
Start with a count. How many AI agents and other non-human accounts operate in our systems, and who owns each one?
Then test the controls. Which of them hold access permanently? How long does an access request take, compared with how fast an agent acts? Which tools do we use for agents, and were they built for them?
Finally, ask for evidence. If the team says the gap is small, ask for the measurement behind it.
You cannot govern what you have not counted, and you cannot fund a gap you cannot show.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: SailPoint.
