Home > Security and Compliance Blog > Cybersecurity Risk Management > AI Agent Identity Gaps Are Now an Audit Problem

AI Agent Identity Gaps Are Now an Audit Problem

by Patrick Spencer updated October 12, 2026 Cybersecurity Risk Management

Reading Time: 13 minutes

Roughly four in five enterprises now run AI agents in production, and fewer than half say they are prepared to answer an auditor who asks what those agents were allowed to touch. That is the uncomfortable center of the SailPoint Horizons of Identity Security 2026-2027 report, and it is the number a CISO or Chief Compliance Officer should read twice.

The report is the fifth annual edition of a survey that reached 340 senior identity, IT, cybersecurity, and risk leaders across North America, Europe, Asia Pacific, and Latin America, every one of them at an organization with 1,000 or more employees. SailPoint sells identity software, so treat this as a vendor-sponsored survey and weigh it accordingly. The findings that matter most to anyone who answers to a regulator are not the flattering ones, which is a good reason to take them seriously.

Table of Contents

Here is the pair that frames everything else. Seventy-nine percent of respondents run AI agents in production. Two percent use tools built specifically to secure agent identities. SailPoint calls that a 40-to-1 mismatch between ambition and infrastructure. Call it what it is, an evidence problem waiting for a date on the calendar.

This post reads the SailPoint data the way an assessor would, then shows where governance at the data layer, through Kiteworks Compliant AI and the broader Kiteworks secure data exchange, closes the gap that identity tooling alone leaves open.

Key Takeaways

1. Adoption has outrun control.

Seventy-nine percent of surveyed enterprises run AI agents in production, while only 2 percent use tools built specifically to secure agent identities.

2. Confidence is not evidence.

Fifty-seven percent of leaders feel confident they can meet regulatory requirements for AI, but only 43 percent feel prepared to produce the specific evidence an auditor would demand.

3. Agents are a second identity class, and most programs govern only the first.

Fifty-four percent of organizations sit at the lowest maturity tier for agent identity, against 23 percent for human identity.

4. Nobody clearly owns the problem.

The CISO, CTO, and CIO were each ranked the most important decision-maker by roughly a quarter of respondents, which describes an accountability vacuum rather than an org chart.

5. Evidence is built into the architecture, not assembled after the inquiry.

Human and agent access must run under one policy, one identity chain, and one audit trail, so the proof exists before anyone asks for it.

The 79 to 2 Gap Is an Evidence Problem

Start with the second-order numbers, because they explain why the headline gap is wider than it looks. Sixty-five percent of organizations have handed agents to more than a quarter of their workforce. Sixty-two percent still rely on legacy technology for more than a quarter of their identity and access management. Only 23 percent monitor a large majority of their agentic environment.

Read those three together and a pattern emerges that has nothing to do with exotic AI risk. Agents are spreading through the business faster than the plumbing that identifies them, scopes them, and records what they did. Nobody decided to skip governance. Deployment simply moved at the speed of a pilot that became a program, and the controls stayed at the speed of a ticket queue.

The tooling story is where perception and reality part ways. In the same survey, 80 percent of leaders believe the gap between their current tooling and what they need is moderate or smaller. Only 15 percent can provision non-human access in real time. Both of those can be true only if “moderate” means something very different to the person answering than it will to the person auditing.

That is the first lesson for anyone who answers to a regulator. When a regulator or assessor asks about an agent, the question is never whether you have a policy. The question is whether you can produce a record, for that specific agent, showing who authorized it, what it accessed, and under which rule. A survey answer cannot do that. A log can.

You Trust Your Organization is Secure. But Can You Verify It?

Read Now

Agent Identity Matures Five Years Behind Human Identity

SailPoint scores organizations on a five-tier maturity scale it calls the Horizons, running from no formal program at Horizon 1 to a self-governing identity fabric at Horizon 5. The most useful chart in the report splits that score into human identity and non-human identity, and the two curves barely resemble each other.

On the human side, the study began in 2022 with 45 percent of organizations at Horizon 1. Today that share is 23 percent, and 67 percent have reached Horizon 3 or beyond. On the agent side, 54 percent sit at Horizon 1 right now, which is worse than where human programs started five years ago.

SailPoint does the arithmetic for you. If agent identity follows the same five-year curve that human identity followed, adequate maturity will not arrive until the early 2030s. With 79 percent of organizations already running agents, the report concludes that the five-year human curve must become a one-year agent curve. I would put it more bluntly. Waiting for agent governance to mature on its own schedule means running regulated workflows on an immature control for most of a decade.

Zoom out and the overall picture is no better. Roughly 60 percent of organizations remain at Horizons 1 and 2, and fewer than 1 percent have reached Horizon 5. Horizon 1 alone has anchored about four in ten organizations in every edition of the survey, which suggests an architectural ceiling rather than a lack of effort. Programs built to govern employees through joiner, mover, and leaver workflows and periodic access reviews run out of road when the identity in question is a process that spins up, acts, and disappears in minutes.

Confidence Theater Hides the Readiness Gap

Every organization has a version of this: a dashboard that is green, a leadership team that is optimistic, and a control that has never been tested against the question an auditor will ask. I call it confidence theater, and the SailPoint data documents it in three matched pairs.

On tooling, 80 percent say the gap is small, while 15 percent can do the thing that defines the gap. On strategy, 88 percent rate identity as an organizational focus, while 41 percent have a non-human identity strategy explicitly aligned to the enterprise AI roadmap. On regulation, 57 percent express confidence in meeting requirements, while 43 percent feel highly prepared to produce evidence in an AI-related audit inquiry.

The third pair deserves the most attention, because it is the only one that maps directly onto a regulator’s clock. Confidence in meeting requirements is an opinion. Evidence in an audit inquiry is an artifact. A 14-point difference between the two is the distance between telling an examiner you believe you are compliant and handing them something that proves it.

SailPoint is careful to note that this is not a competence failure. The same organizations that run human identity well are the ones struggling to extend equivalent controls to machines and agents. One CISO at a large educational institution described what that looks like on a Tuesday afternoon. A review of an enterprise AI platform’s administrative console found roughly 30 licenses still assigned to accounts that should have been offboarded, because disabling the primary identity did not trigger lifecycle management for every downstream AI entitlement.

Thirty orphaned entitlements is a small number. It is also exactly the kind of finding that turns a clean audit into a scoped one.

Auditors Will Sample Everything

The audit pressure is arriving from both sides. According to the report, 69 percent of organizations already include AI agents in their identity audits, and 81 percent expect their compliance and audit workload to increase over the next 12 to 24 months. The auditors are already looking, and the volume is about to go up.

One CISO on SailPoint’s advisory panel described the implication in terms I have not been able to shake. “AI is going to make the auditors superhuman too,” the CISO said. “Rather than sampling ten items for cost reasons, they will be able to sample everything and find every flaw…” If that is where assurance work is heading, a control that works on average but fails on the ten-thousandth transaction stops being an acceptable control.

Now put that next to what leaders say worries them. In the survey, compliance and regulatory risk was the least-cited top-of-mind concern about AI agents, named by 4 percent of respondents. Data leakage and exposure led at 35 percent, followed by excessive privileges at 30 percent. When asked to rank investment drivers, 56 percent chose reducing the risk of unauthorized access or breaches, and 44 percent chose meeting regulatory and audit requirements.

I do not read that as complacency about compliance. I read it as a sequencing mistake. The same CISO panel noted the distance between the 69 percent who audit agent identities and the roughly 10 percent who feel extremely prepared for the audit. Those are two very different standards, and the second one is the one a regulator applies.

Here is the part that should reframe the conversation for a compliance leader. Regulators regulate data, not models. HIPAA, CMMC, PCI DSS, SEC, and SOX requirements for access control, audit trails, and encryption apply to regulated data whether a person or an agent touches it. An agent reading a patient record is a HIPAA event. An agent pulling CUI into a prompt is a question for your CMMC 2.0 compliance program. Neither framework carved out an exemption for software.

Two False Extremes: Block the Agents or Bless Them

Faced with that exposure, organizations reach for one of two answers, and both fail.

The first is to block. Freeze agent deployments until governance catches up. The trouble is that the business has already moved. Sixty-two percent of organizations in the survey report a notable productivity gain from securing non-human identities, and 46 percent report safer, faster AI deployment. A blanket freeze does not remove the risk. It drives usage into the shadow channels where nobody can see it.

The second is to bless. Let teams deploy, trust the model vendor’s guardrails, and plan to fix controls later. This is the posture that produces the 30 orphaned licenses and, eventually, the audit finding.

The survey shows where most organizations land between those poles. Asked how they handle tension between deployment speed and governance, 49 percent say they balance both equally, 38 percent lean toward security, and 13 percent lean toward speed. SailPoint’s verdict on the 49 percent is harsh and, I think, fair. A stated posture of balance without the operational capability to enforce it is not a strategy. It is a stall dressed up as a compromise.

The real variable sits underneath both options. It is whether every agent action on regulated data can be attributed to an identity, tied to a human who authorized it, evaluated against a policy, and recorded in a way that survives scrutiny. Organizations that can say yes can move at the speed the business wants. Organizations that cannot are choosing between freezing and gambling, and neither is a control.

Nobody Owns the Agent Problem

Accountability may be the most uncomfortable thread in the data. When respondents ranked the most important decision-makers for adopting agent identity security, 26 percent put the CISO first, 25 percent the CTO, and 24 percent the CIO. Three executives within two points of each other is not a consensus. It is a vacuum with three claimants.

A note of caution applies here, as it does with any ownership split drawn from a single vendor-run survey. This is one 2026 survey of 340 respondents, not a settled industry fact, and I would not build an org chart on it. What I would do is treat the ambiguity as the finding. If your own organization cannot name, in one sentence, who answers to the board when an agent reads something it should not have, you are inside the statistic.

The strongest practical answer in the report comes from a healthcare setting. Eric Burnett, who runs identity and access management at the University of Chicago Medical Center, says every agent needs a human owner, someone accountable for monitoring its behavior and tying its activity back to a person, backed by a clear blueprint of the data and infrastructure it can reach. That is the right instinct, and it carries a lesson that applies far beyond hospitals. Agents are not a separate class of actor free of human accountability. They are identities that act on behalf of people, and the governance model must keep that chain intact.

The industry data shows why healthcare feels this acutely. In the survey’s industry cut, 68 percent of healthcare organizations sit at Horizons 1 and 2, compared with 47 percent in technology and 54 percent in financial services. The sectors with the most sensitive data are not the ones with the most mature controls.

Where Identity Governance Ends and Data Governance Begins

Identity governance and data governance answer different questions, and an audit needs both answers. Identity governance tells you which agents exist, who owns them, what they are entitled to, and when those entitlements should end. It is the foundation, and the SailPoint roadmap is right that discovery and ownership must come first. Sixty-four percent of organizations already govern emerging machine and agent identities through their existing centralized identity platforms, which is a reasonable place to start.

What identity governance does not tell you is what happened at the moment of access. Which record did the agent read? Which policy permitted it? Was the data encrypted in transit and at rest? Where is the immutable log? Those are data-layer questions, and they are the ones an examiner asks after the entitlement review is done.

That is the gap Kiteworks Compliant AI is built to close. It governs agent interactions at the data layer, independent of the model, the prompt, or the agent framework, and every interaction passes through four checkpoints. The agent is authenticated through OAuth 2.0 and linked to the human authorizer who delegated the workflow. The request is evaluated in real time under attribute-based access control against the agent’s identity, the data’s classification, and the context. The data is protected with FIPS 140-3 validated encryption in transit and at rest. Every interaction is written to a tamper-evident audit trail with full attribution and streamed to a SIEM in real time.

Notice what that design does and does not do. It does not treat agents as autonomous actors operating outside oversight. Human users and agents sit under the same governance layer, the same data policy engine, and the same unified audit log across email, file sharing, SFTP, managed file transfer, and forms. It works with any MCP-compatible AI platform through the Kiteworks Secure MCP Server, so the control follows the data rather than the tool of the week.

For organizations with federal exposure, the platform’s compliance posture matters here as well. Kiteworks lists FedRAMP High as in process and holds FedRAMP Moderate authorization since 2017, alongside FIPS 140-3 validation. Those are compliance and evidence credentials, which is the language a CCO or assessor uses, rather than detection claims.

The Evidence Climbs With Maturity, With Caveats

The most encouraging finding in the report is that audit readiness is not a fixed trait. It rises with maturity, and it rises sharply. In the survey’s breakdown by Horizon band, 18 percent of organizations at Horizons 1 and 2 describe themselves as highly prepared for an AI-related audit. At Horizon 3 that figure is 67 percent, and among Horizon 4 and 5 organizations it is 73 percent.

SailPoint also builds a composite of four governance measures that climbs from 21 percent at Horizon 1 to 88 percent at Horizon 4. Two cautions belong next to those numbers. The responses are self-reported, and SailPoint itself labels the relationship a correlation, not proof of causation. The Horizon 4 and 5 group is also small, 44 respondents, so the top-tier figures are directional.

Even with those limits, the direction is hard to argue with. Organizations that automate discovery, standardize lifecycles, and enforce policy consistently produce a continuous audit trail as a byproduct, which turns an audit from a scramble into a proof point. The business case extends beyond compliance too. Among Horizon 4 and 5 organizations, 80 percent report notable productivity gains and 77 percent report safer, faster AI deployment, against 47 percent and 26 percent at the foundational tiers.

For a CISO fighting for budget, that matters. Governance that produces evidence also removes the approval bottleneck that slows AI projects down. Compliance becomes the reason the program can scale rather than the reason it stalls.

Five Moves to Make Before the Auditor Asks

Count the agents you have. SailPoint found that 29 percent of enterprises report limited or absent visibility into non-human identities, and discovery is where the report says every program should begin. Catalog every service account, API token, script, and autonomous agent, and attach a named human owner and a documented business purpose to each one. SailPoint’s own guidance is to resist the temptation to deploy dynamic authorization before baseline discovery is done.

Name the executive who answers for agent behavior. If the answer today is “it depends who you ask,” you have found your first audit finding. Write the name down, give the role a mandate, and put agent governance on the agenda of whichever committee already reviews privacy and security risk.

Bind every agent to the person who authorized it. An agent without a traceable human authorizer is an unattributable access path, and unattributable access is the hardest kind to defend. Enforce that binding at the data layer, where it holds regardless of which model or framework the agent runs on.

Run an evidence drill on one agent. Pick a live workflow that touches regulated data and ask your team to produce, within a few days, the record of what that agent accessed, under which policy, and with what encryption. If it takes weeks, your regulator’s clock will beat your process. A CISO Dashboard that surfaces agent and human activity in one place shortens that drill considerably.

Stream the evidence to where your security team already works. An audit log that sits in an isolated console is a record. An audit log feeding your detection and response workflow is a control. Wire agent activity into the systems your analysts already watch, so a misbehaving agent shows up in the same queue as a misbehaving user.

None of this requires rebuilding your identity program. SailPoint makes the same point. The immediate priority is extending the governance disciplines that already protect the human workforce to the non-human identities operating across the estate. The organizations that do it this year will answer the auditor’s question in days. The rest will be reading about it in a findings letter.

To learn more about producing audit-ready evidence for AI agent access to regulated data, schedule a custom demo today.

Frequently Asked Questions

For regulated data, yes. Requirements for access control, audit trails, and encryption under frameworks such as HIPAA attach to the data, not to the type of identity that touched it. An agent reading protected health information is subject to the same obligations as the employee who delegated the task. Your auditor will not ask whether the actor was human. They will ask whether you can prove the access was authorized and recorded, using a complete audit trail.

Plan around five questions an assessor is likely to ask. Which agent acted, and which human authorized it? What data did it touch? Which policy permitted the access? Was the data protected in transit and at rest? Where is the tamper-evident record? SailPoint’s data shows only 43 percent of leaders feel highly prepared to answer questions like these. A governed audit log streamed to your SIEM and surfaced through a CISO Dashboard is the practical way to answer them on demand.

It covers part of the problem, and it is the right place to start. SailPoint reports that 64 percent of organizations already govern emerging machine and agent identities through their existing centralized identity platforms, which gives you inventory, ownership, and lifecycle control. What identity platforms do not record is what each agent did with the data once it had access. Pairing your identity and access management program with data-layer enforcement through Kiteworks Compliant AI gives you both halves of the evidence.

Today, in most organizations, that question has no settled answer. In SailPoint’s 2026 survey of 340 leaders, the CISO, CTO, and CIO were each named the top decision-maker for agent identity security by roughly a quarter of respondents. Treat that ambiguity as the risk. Name a single accountable executive, require a human owner for every agent, and document the delegation chain so responsibility is traceable. A formal approach to AI data governance makes those assignments auditable.

A freeze rarely helps, because usage tends to migrate to channels you cannot see. In the survey, 62 percent of organizations that secured non-human identities reported notable productivity gains, and 46 percent reported safer, faster AI deployment. The better move is to put governance in the data path so projects can ship under policy. Routing agent access through a Secure MCP Server with zero trust generative AI principles lets teams keep moving while every action stays attributable.

Additional Resources