SailPoint, has released its fifth annual Horizons of Identity Security report at its Navigate conference. The study finds that AI adoption has raced ahead of the controls needed to govern it. 79% of organisations now run AI agents in production. Only 2% use identity security tools designed to manage those agents. That is a 40-to-1 gap.
Humans Are Catching Up, Agents Are Not
Organisations have made real progress on human identity security. The share at Horizon 1, the earliest maturity stage, has nearly halved. It fell from 45% in 2022 to 23% today. Agent identity starts far behind. 54% of organisations still sit at Horizon 1 for agents.
Companies cannot wait five years to catch up. They must squeeze a five-year human security curve into one year for agents.
Wendy Wu, Chief Marketing Officer at SailPoint, said many organisations do not realise they lack tools built for the scale and speed of agent and non-human identity security. Faster human-speed tools will not close the gap, she said. Security must run at machine speed, with discovery, ownership and access decisions made in real time, not in quarterly reviews. Firms that wait for agent programmes to mature like human programmes will learn they do not have five years, she added.
Where the Gaps Sit
AI agents now make up 22% of all non-human accounts. Yet 85% of organisations still rely on legacy identity tools not built for agents. About 60% remain in Horizons 1 and 2, and under 1% have reached Horizon 5. Non-human identities drive the lag. 87% rate their human identity and access management as capable or better, but only 43% report mature processes for agentic access.
Leaders also underrate the problem. 80% think their tooling gap is moderate or smaller. Yet only 15% can provision non-human access in real time. 57% feel confident about meeting regulatory requirements, but only 43% feel ready to produce verifiable evidence in an AI-related audit.
Basic hygiene is the main roadblock. Credential lifecycle management, shadow AI discovery and real-time monitoring rank as severe hurdles.
The Payoff From Acting Early
Securing non-human identities delivers fast returns. 62% of organisations that invested report measurable productivity gains. 46% report safer, faster AI deployment. 76% of leaders expect stronger identity governance to help their cyber insurance eligibility or terms.
The report urges security leaders to move from a fragmented, human-focused approach to one identity fabric. It should cover humans, machines and AI agents, with continuous, context-aware automation. Mature organisations are twice as likely to see major productivity gains. They are three times more successful at deploying AI safely. The report says this turns compliance from a rushed audit into continuous assurance.
