As artificial intelligence deepens its roots within corporate software stacks, the cybersecurity industry is reckoning with a profound paradigm shift. According to data highlighted in the upcoming 2026 State of Agent Security Report, corporate environments are quietly playing host to approximately 1,280 third-party products that embed artificial intelligence capabilities. Yet, out of that substantial total, roughly 282 sit comfortably behind single sign-on infrastructure. The remaining one thousand operate entirely unseen by standard identity management stacks by default.
This startling discrepancy does not stem from malicious concealment or administrative oversight. Rather, it highlights a structural limitation inherent to modern identity infrastructure: an identity stack can only govern what explicitly authenticates through it. Because the vast majority of autonomous agents never pass through a traditional single sign-on gate, they remain completely invisible to the very systems designed to secure corporate networks.
This visibility gap represents the clearest expression of a transformation that security leaders are only beginning to name and categorize. For several years, "AI security" addressed a fundamentally first-party problem. Enterprises would proactively decide to adopt artificial intelligence, procure official licenses, deploy a designated model behind a managed gateway, and instruct security teams to point appropriate controls at the asset the business had intentionally chosen. Autonomous agents, by contrast, do not arrive through traditional procurement channels. They manifest natively inside software platforms that the enterprise already runs, infiltrating workflows without a formal executive decision or security review.
Why the Decision Point Mattered More Than the Controls
Traditional enterprise security toolkits rely on a foundational assumption: that a definitive adoption moment exists. Model scanning protocols assume a specific model was intentionally selected for evaluation. Prompt inspection tools assume an enterprise gateway was purposely deployed. Acceptable-use policies presume there was a formal organizational adoption process to accept. Historically, that singular moment of adoption provided security departments with a vital window for review, a tangible surface area to instrument, and an accountable owner to name.
Autonomous agents systematically bypass this critical decision point. A prime illustration of this phenomenon is Salesforce’s Slack Code feature, which allows any user to tag a coding agent directly into an active conversation. The agent immediately reads the shared conversational context, writes functional code, and opens a pull request. Official product announcements often boast that such agents inherit native security models, permissions, and administrative controls from day one, requiring zero additional IT lift.
However, when a seasoned enterprise security team reads that description, they interpret it quite differently. They see an autonomous actor with deep, privileged reach into corporate GitHub repositories and production infrastructure, governed by nothing more rigorous than a chat tool’s channel membership. Because the tool was bundled into an existing platform update, there was nothing for security teams to instrument, review, or intercept, simply because there was never an official adoption phase.
Three Launch Vectors, One Destination
Historically, enterprise security leaders have attempted to categorize artificial intelligence integration into two distinct buckets: bought solutions and built solutions. Yet, the rapid evolution of software has introduced a third vector, which has quietly become the largest category of all. Inherited agents ship directly inside existing platforms via routine product updates, requiring no active procurement. Configured agents represent an enterprise’s custom prompts and internal logic operating on external runtimes, models, and third-party connectors. Finally, built agents consist of open frameworks deployed on infrastructure that the enterprise owns and manages end-to-end.
The first two categories—inherited and configured agents—account for the overwhelming majority of modern enterprise adoption and are expanding exponentially as virtually every major business application transforms into an agent platform. Conversely, the third category, built agents, remains the smallest and slowest-growing subset. Ironically, it is also the only category that features a traditional code repository to scan and a build pipeline to gate.
Regardless of their point of origin, all three vectors ultimately lead to the same destination. An agent born inside a customer relationship management system inevitably ends up reading a centralized data warehouse and writing directly to an enterprise ticketing system. Similarly, an agent assembled on a cloud platform frequently ends up holding persistent tokens to critical systems like Salesforce, Slack, and Google Drive. The enterprise application layer serves as the universal execution environment for these tools, and it possesses no fixed or predictable edges.
Four Core Questions That Work on Any Agent
To effectively govern this sprawling ecosystem, security teams must recognize that every agent consists of two distinct components: the underlying model that performs the reasoning, and the operational scaffolding surrounding it. This scaffolding transforms a statistical model into an active agent, deciding what external systems it is wired to, what programmatic functions it may execute, and when it is permitted to take action. Notably, almost none of the actual security risk resides within the model itself; instead, the risk lives entirely within the scaffolding and the interconnected ecosystem in which that scaffolding operates.
Industry experts suggest that evaluating any agent requires focusing on four critical areas, none of which rely on guessing how a model might behave in isolation. The first area is identity, which questions whether the agent is properly registered anywhere within the organization, whether a named human being claims ownership, or whether it silently executes with the permissions of whoever happened to deploy it.
The second area focuses on permissions, examining what the agent is authorized to do and determining whether those privileges exceed its functional requirements. This involves investigating whose OAuth scopes and enterprise roles the agent inherited at creation, and whether anyone intentionally approved those grants.
The third area addresses connectivity, evaluating what the agent can reach—both directly and transitively—through the various products, authorization grants, data stores, and other agents it touches. This is fundamentally the blast-radius question, and it is rarely answerable simply by reviewing an agent’s individual configuration screen.
The fourth area involves activity monitoring, tracking what the agent is actually doing in practice and determining whether that behavior aligns with its intended purpose, judged strictly by observed actions rather than the descriptive text found in its prompt.
Among these evaluation areas, connectivity represents the critical dividing line where modern agent security separates itself from legacy security solutions. Traditional vendor questionnaires, prompt filters, and model scanners evaluate an agent strictly in isolation. In contrast, reach is an emergent property of the entire enterprise environment.
The Influence of Industry Leaders and Regulatory Pressures
Enterprise buyers wielding significant influence have already begun adapting to these emerging realities. Patrick Opet, global Chief Information Officer of JPMorgan Chase, issued a stark warning to the software industry regarding the systemic risks posed by third-party supply chains, citing serious incidents that forced the financial institution to isolate compromised suppliers. Opet has since applied that exact same rigorous scrutiny to autonomous agents. Ideally, an enterprise agent should receive a distinct digital identity but zero baseline entitlements by default, with IT departments explicitly confirming whose authority the agent acts on behalf of before granting access outside a tightly defined boundary. When a financial institution of that magnitude designates autonomous agents as a primary supply-chain risk, similar security inquiries rapidly propagate across the broader corporate landscape.
Regulatory bodies are shifting their compliance frameworks around identical assumptions. The implementation phases of the European Union AI Act place strict obligations on enterprises, presuming that any organization can accurately inventory its artificial intelligence systems, designate clear ownership, and evidence continuous operational oversight. An enterprise that lacks the capability to enumerate its active agents will find itself unable to meet these regulatory standards.
What a Sustainable Security Capability Looks Like
The traditional approach of managing dozens of tools through static spreadsheets and quarterly manual reviews collapses entirely once an organization crosses a threshold of five hundred agents. Moreover, in an era of rapid software updates, an enterprise managing five hundred agents is often only a single product update away from managing five thousand.
What must replace legacy review processes is a live, continuously refreshed capability that instantly answers critical operational questions. Security teams need immediate visibility into what is actively running, what specific privileges each agent inherited, what systems it can reach directly and through interconnected chains, what actions it is currently performing, and how all of those parameters have shifted since the previous day.
Several modern security platforms are specifically engineered around this dynamic visibility model. One prominent example is Reco, whose Reco Graph maps every human and non-human identity, software application, permission grant, and agent action into a single unified live view. By utilizing this architecture, organizations can make reach—rather than static configuration settings—the primary unit of analysis.
The cybersecurity industry spent the past decade developing protective measures for the artificial intelligence systems that enterprises deliberately chose to adopt. However, the autonomous agents that arrived without formal organizational authorization now constitute the vast majority of the corporate AI landscape. Navigating this new frontier requires shifting from isolated component scanning to holistic, ecosystem-wide governance.
