GuidePoint Security has announced the publication of a new IDC White Paper, “Managing Agentic AI Through the Identity Control Plane: What Organizations Should Look For.” Sponsored by GuidePoint Security, the research draws on in-depth interviews with senior security and identity leaders, along with data from multiple IDC surveys spanning nearly 3,600 respondents.
The central finding points to identity as the foundational control plane for agentic AI, because data permissions, runtime controls, and audit records all depend on knowing which agent is acting.
The research highlights a growing gap between AI agent deployment and security governance. Organizations are deploying AI agents faster than their security programs can account for them, creating visibility and ownership challenges.
"Organizations are deploying AI agents faster than their security programs can account for them, and most don't have a clear picture of what's already running," said Kevin Converse, Vice President, Identity and Access Management, at GuidePoint Security. "This research confirms what we’re seeing with our customers: visibility, ownership and scoped access need to be built into agentic AI from the start."
Key findings show non-human identity security is outpacing IAM programs. All participants said non-human identities are outpacing their identity and access management programs, with ratios of non-human to human identities cited as high as 75 to 1. Continuous identity discovery remains limited, with 77.3% of organizations reporting high or very high confidence they can see all identities across their environment, yet only 18.5% run identity discovery continuously or in near real time.
Non-human identity compromise now rivals credential theft. Abused non-human identities were the leading initial entry point in 19% of the most recent confirmed identity incidents, effectively tied with phished or stolen credentials at 19.5%.
The research identifies four critical capability areas organizations should prioritize: governance, risk and policy frameworks for agentic AI; AI-driven threat detection and identity threat response; agent and non-human identity life cycle and ownership; and privilege right-sizing with just-in-time access. It also provides a four-stage maturity model to help security leaders assess where they are today and determine the right next step.
“The architecture will continue to evolve, but organizations don’t need to wait for it to settle,” Converse added. “Treat AI agents as another form of identity to be managed. A named owner, an accurate inventory and a clean revocation path are all necessary security fundamentals for managing this new class of identity that operates at machine speed.”
The findings emphasize that organizations must treat AI agents as another form of identity to be managed. Establishing a named owner, accurate inventory and clean revocation path are essential security fundamentals for managing this new class of identity that operates at machine speed, enabling enterprises to secure agentic AI adoption while maintaining compliance and minimizing risk.
About GuidePoint Security
GuidePoint Security helps organizations overcome the most complex cybersecurity challenges, mature their security posture, minimize risk and ensure compliance. As a trusted cybersecurity advisor and partner, GuidePoint keeps people, data, and operations safe. We deliver tailored cybersecurity services and offerings that adapt and scale to safeguard the nation’s leading organizations today, while preparing them to confidently face tomorrow's cyber challenges. More than 5,900 organizations of all sizes and across every industry, as well as over half of U.S. cabinet-level agencies, rely on GuidePoint to strengthen their defenses and reduce risk. Stronger Together. Protecting What’s Next.
