On October 6, SailPoint published its 2026-2027 Horizons of Identity Security report, built on a survey of 340 senior identity, IT, cybersecurity and risk leaders. One caveat belongs next to it: SailPoint sells identity security software, so it has a commercial interest in the gap it describes. Even so, the two central figures are hard to argue with, and Channel Insider, which covered the report the next day, reproduced them without objection: 79% of organizations already run AI agents in production, and only 2% use identity security tools built specifically to govern them. SailPoint calls it a 40-to-1 gap between adoption and readiness.
The rest of the report explains where that gap comes from. AI agents already account for 22% of the non-human accounts in the companies surveyed, yet 85% of organizations still manage them with legacy identity tools or with whatever controls come bundled with each platform. Asked to rate their own capabilities, 87% consider their handling of human identities capable or better, but only 43% report mature processes for agent access. Only 15% can provision non-human access in real time, which matters for software that works around the clock and does not wait for the quarterly permissions review. On the report's own maturity scale, 54% of companies sit on the lowest rung for agent identity, against 23% for human identity, a rung that held 45% of them in 2022; Wendy Wu, SailPoint's chief marketing officer, describes the task ahead as "compressing a five-year maturity curve into a single year." And while 57% feel confident about meeting regulatory requirements, only 43% feel prepared to produce verifiable evidence in an AI-related audit.
What the operating system saw
Four days earlier, on October 2, Apple posted a notice on its developer news site announcing additional controls on Full Disk Access in macOS, the permission that lets an application read almost everything on a Mac and that was created for backup software. Apple writes that some developers are using it in ways that expose files, mail, messages and browsing history without users fully understanding it, and that as AI agents become more capable and autonomous, "the risks associated with this level of access will grow substantially." From now on, anyone who genuinely wants to grant that access will have to do so through a very explicit action. No date or macOS version has been announced.
What to do if you already have agents running
- Count your agents before you buy anything. The report itself puts discovery and ownership first: list every agent that works with credentials in your company, including the ones a department set up on its own, and write down who answers for each. An agent with no owner is an account nobody will ever switch off.
- Give each agent credentials of its own, with the least access the task needs. An agent that reuses an employee's login inherits everything that person can see. With separate accounts limited to the systems and actions it requires, you can revoke one agent without touching the rest.
- Treat broad permissions the way Apple now treats Full Disk Access. If a tool asks for access to everything, whether a whole drive, a whole mailbox or the entire customer database, make it an explicit, documented decision by a named person, not a box ticked during installation.
- Be ready to answer the auditor's question today. Fewer than half of the companies surveyed feel ready to show verifiable evidence in an AI-related audit. Keep a record of each agent's actions and of the data it touched, so the answer exists before anyone asks for it.
On our own team, every agent we deploy comes with a named human supervisor, and that is also the first thing we would ask of any supplier before letting one of its agents into our systems.