Findings point to identity as the foundational control plane and provide a four-stage maturity model for managing AI agents

RESTON, Va.: #IAM--GuidePoint Security, the cybersecurity advisor and services partner organizations rely on to protect what matters most, today announced the publication of a new IDC White Paper, “Managing Agentic AI Through the Identity Control Plane: What Organizations Should Look For.”

Sponsored by GuidePoint Security, the research draws on in-depth interviews with senior security and identity leaders, along with data from multiple IDC surveys spanning nearly 3,600 respondents. Its central finding: identity is the foundational control plane for agentic AI, because data permissions, runtime controls, and audit records all depend on knowing which agent is acting.

"Organizations are deploying AI agents faster than their security programs can account for them, and most don't have a clear picture of what's already running," said Kevin Converse, Vice President, Identity and Access Management, at GuidePoint Security. "This research confirms what we’re seeing with our customers: visibility, ownership and scoped access need to be built into agentic AI from the start."

Additional key findings include:

• Non-human identity security is outpacing IAM programs. All participants said non-human identities are outpacing their identity and access management programs, with ratios of non-human to human identities cited as high as 75 to 1.
• Continuous identity discovery remains limited. 77.3% of organizations report high or very high confidence they can see all identities across their environment - yet only 18.5% of organizations run identity discovery continuously or in near real time.
• Non-human identity compromise rivals credential theft. Abused non-human identities were the leading initial entry point in 19% of the most recent confirmed identity incidents, effectively tied with phished or stolen credentials at 19.5%.

The research identifies four critical capability areas organizations should prioritize: governance, risk and policy frameworks for agentic AI; AI-driven threat detection and identity threat response; agent and non-human identity life cycle and ownership; and privilege right-sizing with just-in-time access. It also provides a four-stage maturity model to help security leaders assess where they are today and determine the right next step.

“The architecture will continue to evolve, but organizations don’t need to wait for it to settle,” Converse added. “Treat AI agents as another form of identity to be managed. A named owner, an accurate inventory and a clean revocation path are all necessary security fundamentals for managing this new class of identity that operates at machine speed.”

For more information:

• Download the white paper “Managing Agentic AI Through the Identity Control Plane: What Organizations Should Look For”
• Read our blog
• Explore more AI and Identity & Access Management resources

IDC White Paper, sponsored by GuidePoint Security, Managing Agentic AI Through the Identity Control Plane: What Organizations Should Look for, #US54897326-WP, September 2026

About GuidePoint Security

GuidePoint Security helps organizations overcome the most complex cybersecurity challenges, mature their security posture, minimize risk and ensure compliance. As a trusted cybersecurity advisor and partner, GuidePoint keeps people, data, and operations safe. We deliver tailored cybersecurity services and offerings that adapt and scale to safeguard the nation’s leading organizations today, while preparing them to confidently face tomorrow's cyber challenges. More than 5,900 organizations of all sizes and across every industry, as well as over half of U.S. cabinet-level agencies, rely on GuidePoint to strengthen their defenses and reduce risk. Stronger Together. Protecting What’s Next. Learn more at guidepointsecurity.com.

Fonte: Business Wire