SailPoint has released its fifth annual Horizons of Identity Security report, warning that enterprise adoption of AI agents is moving ahead of the identity security controls used to govern them.
The report, released during the company’s Navigate conference, is based on a survey of 340 senior identity, IT, cybersecurity and risk leaders across North America, Europe, Asia Pacific and Latin America.
According to the study, 79% of organisations are running AI agents in production, while 2% are using identity security tools designed specifically to manage and govern AI agents. The report describes this as a 40-to-1 gap between adoption and security readiness.
The findings also point to a maturity gap between security programs for human and non-human identities. SailPoint said the proportion of organisations at “Horizon 1” maturity for human identity security has fallen from 45% in 2022 to 23% today, while 54% of organisations are at Horizon 1 for agent identity security.
Wendy Wu, Chief Marketing Officer at SailPoint, said:
“Compressing a five-year maturity curve into a single year presents a massive operational challenge, starting with a fundamental awareness gap. Many organisations don’t yet realise that they do not have the right tools purpose-built for the scale and velocity of agent and non-human identity security. You cannot bridge this gap by asking human-speed tools to work faster; security must be built for machine speed from the ground up, with discovery, ownership, and access decisions happening in real time rather than on a quarterly review cycle. Enterprises waiting for their agent programs to mature the way their human programs did are going to find out the hard way that they don’t have five years.”
Among the report’s other findings, SailPoint said AI agents represent 22% of all non-human accounts, while 85% of organisations continue to rely on “legacy identity tools” not designed for agentic identities. It also reported that roughly 60% of organisations remain in Horizons 1 and 2, and less than 1% have reached Horizon 5.
The study also identified what it called an “awareness gap” in enterprise preparedness: 80% of leaders said the gap in current tooling was moderate or smaller, but only 15% said their organisations can provision non-human access in real time. It added that while 57% of respondents expressed confidence in meeting regulatory requirements, 43% felt prepared to produce verifiable evidence in an AI-related audit.
The report said foundations such as credential lifecycle management, shadow AI discovery and real-time monitoring were rated as severe operational hurdles.
For organisations that have invested in securing non-human identities, SailPoint reported that 62% said they had achieved measurable productivity gains, and 46% reported safer and faster AI deployment. It also said 76% of leaders expect stronger identity governance to improve eligibility for, or terms of, cyber insurance.
In comments provided for Australian and New Zealand audiences, SailPoint ANZ Group Vice President Nam Lam said: “Australian and New Zealand organisations are rapidly embracing AI to drive innovation and efficiency, which is a testament to the region’s agility. However, our latest report reveals that 79% of organisations globally are managing non-human identities including AI agents with legacy identity security controls. This isn’t just a technical gap, it’s a significant business risk that leaves the door wide open for breaches. In Asia Pacific, with 37% of organisations still at the earliest stage of identity maturity, the immediate priority for ANZ leaders must be to extend their identity security strategy to discover, govern, and protect every single identity; human and non-human, because when something goes wrong, the tough questions will come from the board and local regulators.”
The report concludes that security leaders should move from a human-centric approach to a unified identity model covering human, machine and AI agent identities, and that advancing maturity from Horizons 1–2 to Horizons 4–5 would support real-time visibility and automated policy enforcement for autonomous agents.
SailPoint said the survey evaluated organisations against a five-tier model, ranging from Horizon 1 (no formal program) to Horizon 5 (ecosystem integrated), and assessed factors including strategy, operating models, talent, technical confidence and capabilities.
You can read the full report here.
