Why is the security industry struggling with agentic AI?

The security industry is struggling because agentic AI does not fit cleanly into traditional identity categories, making it difficult to assign responsibility when an action is taken.

What percentage of organizations are experimenting or scaling the use of AI agents according to McKinsey's survey?

Sixty-two percent of respondents say their organizations are at least experimenting with AI agents, and twenty-three percent report their organizations are scaling an agentic AI system.

Why is the RSA conference focused on agentic AI security?

The entire conference felt like an agentic AI show because nearly every vendor was talking about agentic AI security.

What makes agentic AI different from traditional machine identities?

Agentic AI is different because its behavior is non-deterministic by design, unlike traditional machine identities with predictable behavior patterns and static permission sets.

Identity Problem Emerges with Rapid Adoption of Agentic AI in Security Industry

The rise of autonomous AI systems has created a fundamental identity problem, leaving organizations struggling to secure these agents. Learn more at the RSA conference.

The rapid adoption of agentic AI has left the security industry scrambling to address a fundamental identity problem: who or what is responsible when an agent takes an action? The issue was highlighted at the recent RSA conference in San Francisco, where nearly every vendor on the expo floor was talking about agentic AI security. As one attendee noted, "The entire conference felt like an agentic AI show."

The Identity Problem at the Heart of Agentic AI Security

Agentic AI refers to systems that can plan tasks, make decisions, and take actions without continuous human direction. This capability is now showing up in real products because organizations want AI that can complete multi-step work instead of producing one output at a time. The shift matters, marking a move from models that respond to prompts to systems that operate as autonomous workers.

According to McKinsey's recent survey, "The state of AI in 2025: Agents, innovation, and transformation," sixty-two percent of respondents say their organizations are at least experimenting with AI agents. Twenty-three percent report their organizations are scaling an agentic AI system somewhere in their enterprises. High performers have advanced further with their use of AI agents than others have, with most business functions seeing AI high performers as at least three times more likely to report that they are scaling their use of agents.

Why Traditional Identity Programs Fall Short

Traditional identity programs operate on a set of assumptions that have been stable for decades. Identities are either human or machine, with human identities being long-lived and tied to an employee or asset lifecycle. Machine identities, service accounts, and API keys are provisioned for specific workloads with predictable behavior patterns and static permission sets.

However, AI agents fit cleanly into neither category. They are not humans, but they act with a degree of autonomy and decision-making that service accounts never possessed. They are not traditional machine identities because their behavior is non-deterministic by design. This creates a fundamental identity problem for agentic AI systems.

Why Agentic AI Security Matters to the Industry

The rapid adoption of agentic AI has left many organizations struggling to secure these autonomous systems. As one security expert noted, "The gap between what these agents can do and what IAM systems can govern about what they do is widening with every new deployment." This creates a critical vulnerability for enterprises, as ambiguity around agent identity and authentication becomes a pressing challenge.

Traditional security models built around human identity and authentication struggle to accommodate digital entities that operate autonomously. To protect themselves against catastrophic security failures, enterprises must establish clear frameworks governing agent identity, authentication, authorization, and accountability.

What Comes Next: Identity-Centric Governance

The industry is now scrambling to address the fundamental identity problem at the heart of agentic AI security. As one expert noted, "CISOs cannot wait for a separate AI security program to mature in isolation. Agentic AI governance must be anchored in identity security." The controls needed start with the basics but must be adapted for autonomous systems.

Every agent should have a distinct identity, and shared accounts and borrowed human credentials are unacceptable. Each agent must have an owner, a business purpose, an approved scope of action, and a defined lifecycle. Access needs to be granted based on the task, not convenience, and privileges should expire when no longer needed.

Key Facts

The rapid adoption of agentic AI has left the security industry scrambling to address a fundamental identity problem.
Nearly every vendor on the expo floor at the recent RSA conference was talking about agentic AI security.
Agentic AI refers to systems that can plan tasks, make decisions, and take actions without continuous human direction.
The shift from models that respond to prompts to systems that operate as autonomous workers is significant.
Traditional identity programs fall short in addressing the unique challenges of agentic AI systems.

The industry must establish clear frameworks governing agent identity, authentication, authorization, and accountability to protect against catastrophic security failures. As one expert noted, "The time to act is not in six months; it is now." The longer organizations wait to implement identity-centric agentic AI governance, the harder it will be to regain control.