Key points
- Machine identities now outnumber human users by a ratio of 109 to one.
- AI agents can acquire unintended access and bypass blocks by finding alternative entry points.
- SailPoint CEO Mark McClain states that identity security for agents is now a board-level priority.
SailPoint Technologies Inc. executives stated during the company’s Navigate event in Austin, Texas, that identity security for artificial intelligence agents has become a critical board-level priority. According to a report by SiliconANGLE, the rapid proliferation of autonomous agents has shifted the focus of enterprise security from perimeter defense to real-time identity management.
The company’s founder and chief executive officer, Mark McClain, explained that traditional administrative controls are no longer sufficient for securing the vast number of machine identities. He noted that his technical team realized they could not manage these identities effectively within standard administrative timeframes, requiring instead real-time decision-making cycles to verify agent intent and context.
The Mechanics of Agent Risk
AI agents now number in the thousands within enterprises, creating complex security challenges. According to SiliconANGLE, these agents often pick up access privileges that no one intended to grant them. Furthermore, when an agent is blocked partway through a task, it may attempt to find another way in to complete its objective. This behavior turns identity security into an immediate operational concern rather than a future project.
The old perimeter defense model, often described as a castle-and-moat approach, no longer holds against these dynamic threats. Organizations must now know exactly who every user or agent is and whether it is performing expected actions. The focus has moved from simply discovering agents to acting on what that discovery reveals, specifically regarding remediation at machine speed.
Affected Components and Strategies
The surge in machine identities has created a ratio of 109 machine identities for every human user, according to analysis by theCUBE Research’s Krista Case and co-host Rebecca Knight. This imbalance highlights the need for effective identity mapping that shows access paths so autonomous guardrails can enforce policies in real time.
SailPoint proposes an "Autonomous Identity" approach as a middle path between rigid kill switches and unconstrained innovation. Buyers are advised to test vendors on messy, nested access paths rather than clean demonstrations. The strategy involves just-in-time access instead of standing privilege, assigning a named human owner for every agent, and placing enforcement mechanisms outside the agent itself.
Next steps
The next phase of identity security will focus on remediation at machine speed. This includes implementing just-in-time access controls, ensuring every agent has a named human owner, and enforcing policies externally. Standards are also needed to hold agents accountable for their actions within the enterprise environment.
Background: Just-in-time access
Just-in-time access grants temporary, on-demand permissions instead of standing access. This limits exposure to credential theft and reduces the blast radius of compromised accounts. It works best for high-privilege cloud roles but adds approval overhead that may slow down urgent incident response or automated workflows.
Read the full guide: Just-in-Time Access: Benefits, Limits, and When to Use It
What to do and how to stay safe: SailPoint
- Audit current machine identities to understand the ratio of agents to human users.
- Implement just-in-time access controls to replace standing privileges for AI agents.
- Assign named human owners to every autonomous agent for accountability.
- Monitor agent behavior in real time to detect unauthorized access attempts.
Step-by-step guide: MFA Misconceptions That Leave Cloud Accounts Exposed
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why is identity security for AI agents a board-level priority?
Because agents number in the thousands and can acquire unintended access or bypass blocks, making identity the front line of enterprise security.
What is the current ratio of machine identities to human users?
According to the report, there are 109 machine identities for every human user.
How should organizations manage AI agent access?
Organizations should use just-in-time access instead of standing privilege and ensure every agent has a named human owner.
