79% of enterprises running AI agents lack security controls

The Adoption-Security Gap

SailPoint, the Nasdaq-traded identity-security company, published findings on October 6, 2026, revealing a stark disconnect between enterprise AI-agent deployment and governance readiness SailPoint Investor Relations. The company's fifth annual Horizons of Identity Security report surveyed 340 senior leaders across identity, IT, cybersecurity, and risk roles globally.

The headline figure was stark: 79% of surveyed organizations reported running AI agents in production, while only 2% used identity-security tools specifically designed to manage and govern AI agents SailPoint Investor Relations. SailPoint characterized the gap as 40-to-1—four decades of adoption outpacing a single year of security readiness.

Agent Identity Proliferation

The report identified another compounding risk: AI agents now represent 22% of all non-human accounts across surveyed organizations. Yet 85% continue to rely on legacy identity tools not designed for agentic identities SailPoint Investor Relations. These legacy systems were built for human users and service accounts, not autonomous software agents operating at machine speed and scale.

SailPoint's official statement underscored the urgency: "With AI agents already active in production, enterprises do not have the luxury of a five-year runway to catch up; they must compress a five-year human security curve into a one-year agent timeline." This framing signals that rapid agent deployment has outpaced the typical enterprise security modernization cycle.

What's at Stake

The findings align with real-world risk vectors. Ungoverned agents can access sensitive data, execute unauthorized transactions, or become vectors for supply-chain compromise. Identity-security tools designed for human authentication workflows—multifactor authentication, risk-based access controls, audit logging—do not natively extend to agent behavior or machine-to-machine workflows at the scale and speed agents operate.

The report's timing coincides with rising enterprise interest in agentic AI systems: autonomous customer-service bots, data-processing agents, and workflow-automation tools are moving from pilot to production faster than legacy governance frameworks can adapt. Identity and access management (IAM) teams, traditionally focused on user provisioning and entitlement review, are now tasked with governing systems they were not designed to control.

Implications for Enterprise Risk

For security and risk leaders, the SailPoint findings highlight an immediate governance gap: most agents operating in production environments lack the identity controls, audit trails, and behavioral monitoring that regulated industries and security standards demand. The gap between agent adoption and purpose-built controls creates a window of exposure that many organizations may not yet have quantified or mitigated.