SailPoint’s The Horizons of Identity Security 2026-2027 report, now in its fifth edition, delivers an uncomfortable message for enterprises: companies have quickly embraced AI agents. Still, the identity controls that keep those agents in check have barely advanced.
The 40-to-1 gap
The report surveyed 340 senior identity, IT, cybersecurity and risk leaders across North America, Europe, Asia Pacific and Latin America. Its headline numbers are stark: 79% of organizations now run AI agents in production, yet only 2% use tools built specifically to secure them. SailPoint calls this a “40-to-1 mismatch” between ambition and infrastructure. Meanwhile, 85% still rely on legacy or platform-native identity tools, and only 4% run a fully modern identity stack.
Stuck in the early stages
SailPoint scores companies on a five-level maturity scale, from “no formal program” to “ecosystem integrated”. Roughly 60% sit in the bottom two levels, and fewer than 1% have reached the top.
The reason is not poor people management. Some 87% rate their human identity capabilities as capable or better. But only 43% report mature processes for agent access, and 54% sit at the lowest level for agent identity. The report’s comparison is telling: human identity maturity took five years to improve. Agents, it argues, cannot wait that long.
Confidence versus reality
One useful finding is the gap between what leaders believe and what their systems can do. Some 80% think the gap in their tooling is moderate or smaller, yet only 15% can provision machine access in real time. Likewise, 57% feel confident about meeting regulations, but just 43% feel ready to produce evidence for an AI-related audit. About 69% already include agents in identity audits, and 81% expect that workload to grow.
Fears are old-fashioned
Leaders are not mostly worried about exotic AI behavior. Their top concerns are data leakage (35%) and excessive permissions (30%). The report’s framing is sharp: the danger is not that agents act unpredictably, but that they act exactly as configured, with too much access for too long. Basic tasks remain challenging, with credential lifecycle management and shadow AI prevention each rated difficult by 58% of respondents.
Security as a business enabler
SailPoint also makes a business case. Among respondents, 62% report productivity gains from securing non-human identities, and 46% report safer, faster AI deployment. The most mature organizations are about twice as likely to report such gains, and nearly three times as likely to see safer, faster AI rollouts. Looking ahead, 76% expect better cyber insurance eligibility or terms.
The roadmap: discover, govern, protect
The report lays out three stages. First, discover: build an inventory of every service account, API token, and agent; detect shadow AI; and assign human owners. Second, govern: automate lifecycles, rotate credentials, and align identity with AI plans. Third, protect: use zero standing privilege, just-in-time access and real-time, context-aware controls linked to security operations. It warns against jumping straight to advanced controls before visibility is in place.
Case studies from Criteo, UChicago Medicine and RWE show the approach in practice, each stressing that every agent needs an accountable owner.
A caveat worth noting
This is vendor research, and SailPoint sells identity security, so its conclusions favor unified platforms. Some findings rest on small samples; the top maturity level, for instance, rests on just two respondents. Even so, the central takeaway is clear: before companies give agents more power, they must first know what those agents are, who owns them, and what they can reach.
