Some 89% of enterprises in EMEA have deployed artificial intelligence (AI) agents, but 99% of these lack the identity security tools to govern them, according to research published by identity management supplier SailPoint.
The supplier published the findings from its Horizons of identity security report to coincide with its Navigate conference in London.
The report paints a picture of company networks overrun by anarchistic “machine citizens”, operating outside the rule of law.
Mark McClain, CEO and founder of SailPoint, said in a statement: “Organisations have raced to build highly capable AI agents in production environments to perform complex tasks, creating a classic case of innovation outpacing governance.
“In any society, autonomy without accountability leads to chaos,” he added. “Because agents act independently, access sensitive corporate resources and hold operational privileges, they are active, functioning members of the corporate ecosystem. To transform this digital paradox into secure innovation, the same ‘good citizen’ societal rules that apply to humans must apply to them. Every agent needs a clear owner, full visibility and strict boundaries.”
In an interview with Computer Weekly, he said the explanation for the “big gap” between the deployment of agents and the ability to govern them lies in “the rush to try to gain business advantage from this technology. And now the security industry is trying to catch up, frankly.
“All of this creates a lot of security risk if you don’t understand what you’ve deployed, what kind of access these things have, where they can potentially go,” said McClain. “There’s this term ‘rogue’ out there today. You could argue it’s rogue. You could also argue it was ungoverned, right?
“The [rogue] agents were just trying to accomplish their mission, but because they didn’t have controls and governance around them, they could go do things they really shouldn’t have been allowed to do.”
The supplier said what it has identified as a governance gap exists despite regulatory pressures from DORA and the EU AI Act pushing organisations toward greater resilience.
The research also called attention to a “broader lack of readiness. Over half (54%) of all organisations in the EMEA region are still stuck in the earliest, most manual stage of their identity security journey. This leaves them without the centralised controls needed to manage even basic non-human identities, let alone sophisticated AI agents.”
The research was conducted among 340 identity security, IT, cyber security and risk leaders globally, 27% of whom were in the EMEA region.
It found that 22% of enterprises in the region possess mature capabilities for detecting shadow AI, meaning unsanctioned and ungoverned agent deployments.
It also found that 62% of the worldwide organisations that have invested in securing non-human identities report measurable productivity gains.
During its Frontier Tour event in London, Microsoft also stressed agent governance. The company’s CEO, Satya Nadella, said he advocated “a set of principles of your trust system.
“I describe them as principles of observability and governance, but you need to identify every agent and you need to be able to log every activity of these agents,” he said.
Nadella said that when an AI agent uses an AI model, it is necessary to log its chain of thought in a human-readable form. This log needs to show that the agent has adhered to the organisation’s governance and compliance rules. And since multiple AI agents may be required to complete a task, each one needs to be uniquely identifiable, he said.
For its part, SailPoint said it has introduced capabilities in its platform “to help move enterprises from chaos to governance, including several classes of agents that organisations can deploy to detect real-time threats and orchestrate other agent classes”.
McClain added: “It is hard to point to any industry that isn’t moving fairly aggressively [with respect to AI and agentic AI]”. In Europe, he said, “there’s a little bit of hesitancy because one of the core value propositions of AI is you can get more efficient and maybe reduce your workforce. In the European continent and in the UK, reducing workforce is a very tricky thing. You’ve got works councils and so on. I don’t think we see that hesitancy in the US.
“My sense is that European companies are trying very much to stay on the front end of technology, just like US companies, just like Asian companies,” said McClain. “So, we’ll see how this adoption works. But there’s not much interest here in cutting the staff through AI. It’s more about productivity gains and doing more.”
