SPECIAL REPORT | AI adoption outpaces security controls — SailPoint study
A growing number of enterprises are deploying artificial intelligence agents in production environments without having specialized security tools in place to govern their access, raising concerns about data exposure, excessive privileges and accountability, according to a 2026–2027 identity security report released by SailPoint.
The Horizons of Identity Security Report 2026–2027, based on a survey of 340 senior identity, information technology, cybersecurity and risk leaders across North America, Europe, Asia Pacific and Latin America, found that 79% of organizations were running AI agents in production, but only 2% had deployed identity security tools specifically designed to govern and secure them.
The findings point to a widening gap between enterprise adoption of autonomous AI systems and the security infrastructure needed to manage their access to company systems, applications and sensitive information.
“Identity architectures built for humans cannot govern autonomous agents executing thousands of transactions per second,” the report said in its executive summary.
SailPoint said organizations continue to rely on traditional identity and access management systems even as AI agents and other non-human identities become more prevalent in enterprise environments.
The report found that 85% of organizations rely on legacy, general-purpose identity tools or platform-native controls, such as on-premises directories and manually maintained access roles, to manage identities.
AI agents accounted for 22% of all non-human accounts, according to the report. These identities include automated systems, service accounts and other machine-based entities that require credentials and permissions to perform tasks.
Most organizations remain at basic security maturity
Despite years of investment in identity management, 60% of organizations remain at the two lowest levels of SailPoint’s five-tier identity security maturity model.
The report classified 41% of respondents at Horizon 1, or organizations without a formal identity security program, and 19% at Horizon 2, where identity tools are available but processes remain heavily dependent on manual work.
Less than 1% of organizations reached Horizon 5, the model’s highest level, which represents an ecosystem-integrated approach to identity governance.
The gap is more pronounced when organizations’ human and non-human identity controls are compared. While 67% of organizations had reached Horizon 3 or higher for human identity security, 54% remained at Horizon 1 for non-human and AI agent identity security.
The report said the difference reflects a gap in coverage rather than a lack of competence among security teams.
“Nearly nine in ten leaders report strong technical capabilities for managing human access, yet nearly a third struggle to extend those same standards across cloud workloads and agentic environments,” it said.
Only 15% of organizations reported being able to provision non-human access in real time, while 15% had mature capabilities for detecting unsanctioned AI use, commonly referred to as shadow AI.
The report also identified a gap between leadership confidence and operational readiness. Although 57% of respondents expressed confidence in their ability to understand and meet regulatory requirements for AI security and governance, only 43% said they were highly prepared to produce evidence for an AI-related audit inquiry.
Data exposure and excessive access lead concerns
The report identified data leakage and exposure as the most frequently cited AI agent security risk, with 35% of respondents naming it among their top concerns. Excessive privileges and access control followed at 30%, while 26% cited autonomous actions without human oversight.
Among identity security teams, excessive permissions and privilege creep were the most frequently cited challenges in managing AI agent identities, mentioned by 28% of respondents. Visibility and discovery problems followed at 22%.
The findings highlight the risks of granting automated systems broader or longer-lasting access than their tasks require. An AI agent operating with excessive privileges could access information or systems beyond its intended purpose, while inadequate monitoring could make unauthorized activity harder to detect.
Mitch Ashley, an industry analyst at The Futurum Group, described the implications of AI systems that can create and execute other agents.
“Identity is foundational. It is where security starts, and if you do not have it you do not have security… Consider that an agent can now be written and executed by another agent, having never existed before, with no pre-existing code to call, because AI builds agents, it does not just run existing ones. That is your ephemeral identity problem in a sentence.”
The report said organizations need to establish clear ownership for every non-human identity, document its purpose and restrict its permissions to what is necessary. Access should also be revoked when a task is completed or an identity is no longer needed.
Audit demands expected to increase
AI-related compliance requirements are adding pressure to organizations that have yet to establish mature identity governance practices.
The survey found that 69% of organizations already include AI agents in their identity audits, while 81% expect their compliance and audit workload to increase over the next 12 to 24 months.
However, the report found that fewer than half of respondents felt highly prepared to respond to an AI-related audit inquiry.
The gap matters as enterprises are expected to demonstrate not only that security policies exist but also that access controls are enforced and that the activities of automated systems can be traced and reviewed.
SailPoint recommended that organizations begin by identifying all machine identities, service accounts, API tokens and AI agents operating across their environments. Each identity should have an accountable owner, a defined business purpose and documented access boundaries.
The report also called for standardized credential management, automated access reviews and continuous monitoring, with more advanced organizations moving toward just-in-time access and automated responses to suspicious activity.
Security investment may also improve productivity
The report presented identity security as an operational concern as well as a defensive measure. Among organizations that invested in securing non-human identities, 62% reported notable productivity improvements. Another 46% reported safer, faster AI deployment, while 46% reported measurable reductions in identity-related security issues.
The results suggest that reducing manual access approvals and establishing consistent governance can help organizations deploy AI systems without relying on informal or fragmented security processes.
Jérôme Robin, director of corporate security at Criteo, said the objective should be to establish safeguards without unnecessarily slowing implementation.
“The objective is not to slow down AI adoption. It is to make AI adoption safe enough to scale.”
For enterprises expanding their use of autonomous systems, the report’s findings point to a practical challenge: AI deployment cannot be separated from identity governance. Organizations must know which agents are operating, what information they can access, who is accountable for their actions and how their permissions can be withdrawn when necessary.
The report concluded that enterprises need to extend established identity governance practices beyond employees to include machines and AI agents, with controls capable of responding to automated activity at machine speed.
Full disclosure: All news articles published on the TechSabado website are written by human journalists, unless otherwise specified. Final text editing is also performed by human editors, with artificial intelligence (AI) used only to assist with additional grammar and style guide corrections..
————————————————————————-
TEN YEARS OF TECHSABADO!
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE & SPOTIFY channels.
WATCH TECHSABADO ON OUR YOUTUBE CHANNEL:
WE ARE ALSO ON SPOTIFY
WATCH OUR OTHER YOUTUBE CHANNELS:
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
