The number that should stop the room in 2026 is 2%. SailPoint’s October 6 announcement put it this way: 79% of enterprises already run AI agents in production – automated workers that complete tasks without a human clicking approve – while only 2% have deployed identity security, the policies and tools that decide which people or machines can touch which data. For every fifty companies running agents, roughly one has bought the machinery built to govern them. That gap is a governance ceiling, not a technology shortage.
The machinery arrived this year. At its Navigate conference on October 6, SailPoint expanded its Agentic Fabric with shadow AI discovery (finding agents the organization never sanctioned), runtime authorization (checking each action while it happens), an instant kill switch to disable an agent, and exportable audit evidence for regulators, with capabilities rolling out beginning at the show. In June, Okta expanded its Cross App Access ecosystem to more than 25 partners – a way for agents to connect to business apps through the company’s own identity system instead of shared secrets, built on the OAuth authorization standard (the common mechanism that lets one app grant another limited access without handing over a password) and adopted as an official extension of the Model Context Protocol, the standard language AI assistants use to call external tools. Okta opened supported applications through its integration marketplace, the Okta Integration Network, in August. CrowdStrike published its own agent-authorization layer in June, but the post’s forward-looking statement says part of it rides the ongoing integration of SGNL technology – a system built to remove standing privileges, the always-on access that never expires – and no general availability date for that piece has been published. All three landed after the OAuth/SAML bypass wave: seven months, eight vendors, one structural failure in the very layer agents now depend on.
On the ground, the incidents are already routine. Gravitee’s State of AI Agent Security 2026 report, based on a survey of more than 900 executives and practitioners, found 88% of organizations reported confirmed or suspected AI agent security incidents in the last year – the report’s own category, incidents and near-misses together. The same survey found only 21.9% of teams treat their agents as independent identities, 45.6% still pass shared API keys (one credential reused across many services), and only 14.4% have full security approval for their entire agent fleet. SpyCloud’s 2026 Identity Threat Report, a self-reported survey of 750 security leaders, put compromised non-human identities – the machine accounts software uses to talk to other software – at the top of the breach-entry list: 31% named them the primary way in, against 17% for phishing. And the volume keeps climbing – Rubrik Zero Labs puts non-human identities at 82 to 1 against human users “by some measures.”
The mismatch in confidence is measurable. Okta’s AI Agents at Work 2026 survey – 292 executives and 492 knowledge workers across seven countries – found 96% of executives confident their identity and access management can secure non-human identities, yet only 34% of organizations always apply the same security controls to their AI agents as to their human employees. The same survey found 90% of executives confident in their visibility into AI tools while 52% of employees admit using tools without approval. The market has been building these standards faster than anyone runs them – a pattern our pre-GA standards coverage already flagged.
Earlier coverage tracked the gap and the buying behind it: the 40x shortfall itself, the agent governance tax, Rhapsody’s own gatekeeper, the agent identity stack forming. Those stories were about what enterprises purchase, and about the gap itself. This one is about what they switch on. The vendors did their part in 90 days. The 2% is no longer a product problem – it is the point where 96% confidence in existing controls meets the 34% who actually apply them to agents. Until those two numbers converge, the incident rate stays exactly where the surveys keep finding it: everywhere.