79% Running, 2% Secured: SailPoint's 40x Identity Gap for AI Agents

On October 6, 2026, SailPoint (Nasdaq: SAIL) released its fifth annual Horizons of Identity Security report from its Navigate 2026 conference in Austin, Texas. The report, based on a global survey of 340 senior identity, IT, cybersecurity, and risk leaders, reveals a gap between AI agent adoption and security readiness that the company describes as 40-to-1.

The Numbers: A 40x Gap

The headline finding is unambiguous. While 79% of organizations are now running AI agents in production, a mere 2% are using identity security tools specifically designed to manage and govern them. This is not a gradual lag. It is a structural deficit.

Several supporting findings paint the full picture:

• AI agents now represent 22% of all non-human accounts in enterprise environments.
• 85% of organizations continue to rely on legacy identity tools not designed for agentic identities.
• 54% of organizations sit at Horizon 1 (no formal program) for agent identity maturity.
• 87% rate their human IAM capabilities as capable or better, while only 43% report mature processes for agentic access.
• Only 15% can provision non-human access in real time.

The Divergence: Human vs Non-Human Identity Maturity

The report reveals a stark divergence in security maturity between human and non-human identities. Organizations have made impressive strides with human security, nearly halving those at Horizon 1 maturity from 45% in 2022 to just 23% today. But the explosion of autonomous AI agents has introduced a new deficit that starts from a much worse baseline.

Agent identity begins at a steep lag, with 54% of organizations at Horizon 1. Roughly sixty percent of organizations remain in Horizons 1 and 2, while less than 1% have achieved Horizon 5 (ecosystem integrated). The report concludes that enterprises do not have the luxury of a five-year runway to catch up. They must compress a five-year human security curve into a one-year agent timeline.

Wendy Wu, Chief Marketing Officer at SailPoint, stated: "You cannot bridge this gap by asking human-speed tools to work faster; security must be built for machine speed from the ground up, with discovery, ownership, and access decisions happening in real time rather than on a quarterly review cycle."

The Awareness Gap That Masks Operational Vulnerability

One of the most concerning findings is the gap between perception and reality. Eighty percent of leaders believe the gap in their current tooling is moderate or smaller. Yet only 15% can provision non-human access in real time. Similarly, 57% express confidence in meeting regulatory requirements, while only 43% feel prepared to produce verifiable evidence in an AI-related audit.

This awareness gap is dangerous because it creates a false sense of security. Leaders believe they are closer to ready than they actually are. The operational reality, as the report shows, is that most organizations lack basic visibility into what agents exist, what they can access, and what they are doing.

The Business Case for Closing the Gap

The report is not solely a warning. It presents a measurable business case for investing in non-human identity security. Among organizations that have invested in securing non-human identities:

• 62% report measurable productivity gains.
• 46% report safer, faster AI deployment.
• 76% of leaders expect stronger identity governance to improve their eligibility for, or the terms of, their cyber insurance.

Mature organizations are twice as likely to realize significant productivity gains and three times more successful at deploying AI safely. The report frames this as transforming compliance from a reactive audit scramble into a state of automated, continuous assurance.

What SailPoint Announced at Navigate 2026

Alongside the report, SailPoint announced several product capabilities at Navigate 2026, as covered by SiliconANGLE on October 9, 2026:

• Zero standing privilege for AI agents, eliminating persistent access that creates unnecessary risk.
• Autonomous agents for identity security, enabling real-time discovery and remediation.
• IdentityIQ 9.0, delivering security and governance built for enterprise scale.
• Human Fabric capabilities for modernizing both cloud and on-premises identity security.

The company's thesis is that the mandate for security leaders is to move from a fragmented, human-centric approach to a unified identity fabric that governs all identity types, human, machine, and AI agent, with continuous, context-aware automation.

What This Means for Your Organization

The SailPoint report has implications that scale to organizations of any size deploying AI agents:

1. Assume agents are already in your environment. Even if IT has not deployed them, employees may have. Discovery is the first step.
2. Inventory every agent. Each agent should have a unique identity that defines what it can access, linked to a specific authenticated human account.
3. Move to zero standing privilege. Agents should receive access only at the moment they need it, not permanently.
4. Shift from quarterly reviews to real-time monitoring. Machine-speed actors require machine-speed controls.
5. Invest in purpose-built tools. Legacy IAM tools were not designed to recognize AI agents as actors. The report is explicit: you cannot bridge this gap by asking human-speed tools to work faster.

The cost of inaction is not abstract. IBM's 2026 report found that 92% of organizations hit by an AI-related breach lacked proper access controls, and nearly 66% have no AI governance policy in place to detect shadow agents.

Read Next

• Shadow AI Agents: The Unregistered Threat Already Inside Your Workflows
• The AI Shelf Index: Why Ranking #1 in Google Won't Get You Cited by AI
• The Great Citation Decoupling: What Q4 2026 Research Reveals About AI Search
• Google's Gemini Coworker Agent Gets Its Own Email: What Persistent AI Identity Means for Business
• Dataiku Agent Management: The Cross-Platform Governance Layer for Enterprise AI Agent Sprawl