Fewer than half of CISOs can spot every AI agent, Okta finds

Most organisations cannot reliably say how many AI agents are running inside them. According to Okta's Global CISO Insights 2026 report, cited in a webinar announcement published by The Hacker News on 28 September 2026, only 47% of chief information security officers are confident they can identify every AI agent in their environment.

The report is quoted in the context of a vendor webinar on governing AI agents, reducing excessive access and controlling so-called shadow AI \u2014 AI tools and agents adopted by staff or teams without the security team's knowledge or approval.

The framing set out in the announcement is that agents are reaching production faster than security teams can govern them. Agents are described as connecting to applications, handling data, calling APIs and acting across business systems. The announcement says this often happens without the same controls that are applied to human users.

That gap matters because the standard tools of enterprise access control assume a human on the other end. Joiners, movers and leavers processes, periodic access reviews and multi-factor authentication are all built around people. An agent that holds a long-lived credential and can call several systems on a user's behalf does not fit neatly into any of those processes. If the security team cannot enumerate the agents, it cannot review what those agents can reach.

"Excessive access" is the second theme raised in the announcement. In identity management, it describes a credential that carries more permission than the task requires \u2014 for example, read and write access to an entire data store when only one table is needed. The concern with agents is that broad permissions are quicker to grant than narrow ones, and harder to claw back once workflows depend on them.

The source material does not give the sample size, the geographic spread or the survey method behind the 47% figure, and it does not break the answers down by sector or company size. It also does not say what proportion of CISOs reported finding agents they did not know about, as opposed to lacking confidence in their inventory. Readers should treat the number as a vendor-published self-assessment rather than a measurement of how many agents are actually unaccounted for.

Even so, the direction is consistent with the way agent deployments are described in the announcement: driven by business teams, connected through APIs, and running with credentials that were issued for convenience rather than designed for least privilege. Okta, which sells identity and access management products, has a commercial interest in that problem being taken seriously. That does not make the finding wrong, but it is worth stating plainly.

For security teams, the practical takeaway from the material is narrow and unglamorous. Before controls can be applied, an inventory has to exist: which agents are running, who owns them, what credentials they hold and which systems those credentials can reach. On the report's own numbers, a little over half of CISOs do not yet have that.