Vendor report warns security moves slower than AI agents

Enterprises deploying autonomous AI agents are running them on identity security built for an earlier era, according to the "Horizons of Identity Security" report from the identity security vendor SailPoint, summarised in an article published on 9 October 2026.

The report's central claim is what it calls a "velocity paradox". Organisations are investing in business operations that run at AI speed, the report says, while continuing to rely on security controls that run at human speed. The result, according to the write-up of the report, is a gap between what the technology can do and what the surrounding controls can keep up with.

The gap matters because of what autonomous agents are: software that takes actions on a user's or company's behalf, rather than simply returning an answer for a person to act on. An agent that can open tickets, move files, call other systems or spend money is making decisions in seconds. Approval workflows, access reviews and manual investigations are measured in days or weeks. The report frames that mismatch as a structural problem rather than a tooling gap at any one company.

The article describes security architectures as "decades behind AI ambition" and says enterprises are "tethered" to them even as they race to deploy agents. It does not, in the material available, quantify how many organisations are affected, how many agents are typically in production, or what proportion of them operate without the controls the report says are needed. No specific breach, product or customer is named.

Readers should note the source of the claim. SailPoint sells identity security software, and the Horizons of Identity Security report is the company's own research. Vendor research is a legitimate source of data about what buyers are doing, but it is produced by a party with a commercial interest in the conclusion that current identity controls are inadequate for AI agents. The findings have not been independently verified in the material reviewed here.

What the report does usefully put a name to is a problem that security teams are increasingly describing in their own terms. If an agent can act faster than any human can review the action, then after-the-fact oversight stops functioning as a control. The practical questions that follow are familiar ones from identity management: what an agent is allowed to do, who approved that, whether the permission expires, and whether anyone would notice if the agent did something outside its remit.

The report does not, on the evidence of the article, claim that any of those questions have been answered. It argues that most organisations are deploying first and answering later.