SailPoint Rolls Out New Capabilities to Address Agentic AI Identity Security Challenge
AI agents are quickly moving from experiments into everyday enterprise environments, but the security controls around them are not keeping pace, according to enterprise identity security company SailPoint. In its latest Horizons of Identity Security report, SailPoint found that 79% of enterprises already have AI agents running in production, while just 2% have deployed identity security tools specifically designed to govern them.
That gap could become harder to ignore as organizations give agents more autonomy. Agents can increasingly access applications, sensitive data, and credentials, and in some cases take actions on a user's behalf, effectively creating a new class of identity that IT and security teams need to manage.
SailPoint, which develops identity security and access governance technology for enterprises, is responding with a collection of new identity security capabilities announced at its Navigate 2026 conference. The company is expanding its Agentic Fabric to discover "shadow AI" agents and provide runtime authorization and controls capable of immediately disabling an agent.
The company also introduced what it calls SailPoint Autonomous Agents, specialized AI agents designed to govern other agents. The security agents can monitor runtime activity, intercept threats, and adjust permissions while allowing legitimate agents to continue operating, SailPoint said.
The idea reflects one of the challenges created by increasingly autonomous AI systems: Traditional human approval processes may not be fast enough to govern software capable of taking large numbers of actions on its own.
"The idea that a security admin is going to review and approve access for a group of autonomous agents making 10,000 tool calls a second isn't just outdated — it's a fantasy," SailPoint CTO Chandra Gnanasambandam said.
Finding Agents Organizations Don't Know About
Another part of SailPoint's approach focuses on visibility.
New endpoint and browser sensors, along with SIEM and XDR telemetry and non-human identity discovery capabilities, are designed to uncover agents, MCP servers, credentials, tools, and data stores that haven't been brought under an organization's identity program.
The company is also introducing Autonomous Identity Security Posture Management, or A-ISPM, which uses identity information from its Atlas platform to identify dormant accounts, orphaned access, shadow administrators, and other potentially risky access paths. Organizations can then revoke access, disable an identity or AI agent, assign an owner or automate enforcement.
Just-in-Time provisioning is another part of the strategy. Rather than giving people, service accounts, and AI agents permanent access, permissions can be granted when needed and subjected to conditions such as reauthentication or a business justification.
Capabilities across SailPoint's Agentic Fabric, Human Fabric, and Atlas platforms are beginning to roll out globally. A-ISPM and several other announced features are expected in the company's fourth quarter of fiscal 2027.
"Autonomous agents are no longer just experimental copilots; they are becoming the primary execution layer of modern enterprises," SailPoint President Matt Mills said.
For more information, visit the SailPoint site.