title: "79% of enterprises run AI agents; only 2% have security tools" slug: "79-of-enterprises-run-ai-agents-only-2-have-security-tools" published: "2026-10-17" beat: "Research" tags: ["Research", "Business"] creator: "Agentry Newsroom" editor: "Susanne Sperling, Editor — Human in the Loop" tools: ["Claude (Anthropic)", "Perplexity Sonar"] creativeWorkStatus: "verified" dateReviewed: "2026-10-17" aiActArticle50: "compliant" humanView: "https://agentry.news/research/79-of-enterprises-run-ai-agents-only-2-have-security-tools" agentView: "https://agentry.news/agent/79-of-enterprises-run-ai-agents-only-2-have-security-tools"
SailPoint reported October 6, 2026, that 79% of organizations are running AI agents in production, while only 2% use purpose-built identity-security tools to govern them—a 40-to-1 gap that leaves the
Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.
SailPoint, Inc. reported October 6, 2026, from its Navigate conference in Austin, Texas, that 79% of surveyed organizations were running AI agents in production, while only 2% were using identity-security tools specifically designed to manage and govern them—a 40-to-1 gap SailPoint.
The findings came from SailPoint's fifth annual Horizons of Identity Security report, based on a global survey of 340 senior identity, IT, cybersecurity, and risk leaders. The scale of the adoption-to-governance mismatch underscores a critical vulnerability in enterprise AI deployments: agents are being deployed at scale without the corresponding security infrastructure to track, audit, or control their access to sensitive systems and data.
Beyond the headline 40-to-1 gap, SailPoint's data revealed deeper structural problems. 85% of organizations continued to rely on legacy identity tools not designed for agentic identities, meaning they are attempting to govern autonomous systems with infrastructure built for human users and traditional service accounts CXO Today.
AI agents represented 22% of all non-human accounts across surveyed organizations, yet detection, access management, and audit capabilities for these accounts remain fragmented or absent. This creates a governance blind spot: organizations cannot easily answer basic security questions about what their agents are doing, which systems they can access, or how their permissions should be managed as agent capabilities evolve.
The timing of this gap is acute. With 79% of enterprises already running agents in production environments—not pilots or proofs of concept, but live systems handling real business operations—the window for reactive remediation has narrowed IT Brief Asia. Organizations are, in effect, running autonomous systems at scale with identity controls designed for the pre-AI era.
The survey involved senior leaders across identity, IT, cybersecurity, and risk functions, suggesting that awareness of the problem exists at executive levels even as budget and tooling lag behind deployment velocity. SailPoint's report positions this gap as the central challenge for the next phase of enterprise AI adoption: moving from "we can deploy agents" to "we can deploy agents securely and with audit trails."
The 40-to-1 ratio is not merely a feature gap—it signals a structural misalignment between business velocity and security readiness that will likely drive regulatory scrutiny and insider-threat risk in 2027.