Almost Nobody Has Bought Agent Security Yet. The Market Is Paying As If Everyone Has.
SailPoint's new survey says 79% of enterprises run AI agents in production and 2% have deployed identity security built for them. The market paid up anyway, with the sector's ETF printing an all-time high the same week on a forecast of 23% annual spending growth.
Vincent Jiang · 3 min read
At SailPoint's Navigate conference on October 6, 2026, the company published the fifth annual Horizons of Identity Security, a survey of 340 senior identity, IT, security and risk leaders: 79% of organizations run AI agents in production, and 2% use identity security purpose-built to govern them 1.
The report is SailPoint's own, issued as a press release, and it landed in the same hour as new Autonomous Agents and Agentic Fabric products aimed squarely at the gap it documents 2. The vendor selling the warning is also selling the cure.
The gap is real, and the market priced the fix before anyone bought it
The survey's sharpest finding is not the 40-to-1 gap but the confidence gap underneath it. 85% of organizations still lean on legacy identity tools never designed for agentic identities, AI agents now account for 22% of all non-human accounts, and only 15% can provision non-human access in real time 1.
54% of organizations sit at the lowest maturity tier for agent identity, yet 80% of leaders rate their current tooling gap as moderate or smaller 1. Only 43% report mature processes for agentic access, against 87% who rate their human identity capabilities capable or better 1.
79% run AI agents in production; 2% have purpose-built security for them
Data
| Value | |
|---|---|
| Rely on legacy identity tools | 85 |
| Run AI agents in production | 79 |
| At the lowest tier for agent identity | 54 |
| Provision non-human access in real time | 15 |
| Use identity security purpose-built for agents | 2 |
The bills the market has already paid
The First Trust Cybersecurity ETF hit an all-time high on October 5, 2026, with CrowdStrike up 132% this year, Palo Alto Networks 131% and Fortinet 97% 3. Zscaler's Jay Chaudhry called agents going rogue "the biggest risk today," and Morgan Stanley analysts, who carry Overweight ratings on Palo Alto Networks, CrowdStrike and Okta, model 23% annual cybersecurity spending growth through 2028, accelerating to 33% if government mandates follow 3.
CrowdStrike, Palo Alto Networks and Fortinet are up 97% to 132% this year
Data
| Value | |
|---|---|
| CrowdStrike | +132% |
| Palo Alto Networks | +131% |
| Fortinet | +97% |
Rubrik printed a 52-week high of $124.27 on October 6, above its own $114.42 average analyst target, even as insiders sold $11.68 million of stock over the previous 90 days 4. The sellers included director Yvonne Wassenaar and chief technology officer Arvind Nithrakashyap, both under pre-arranged trading plans 4.
Rubrik has grown revenue faster than SailPoint in every quarter shown
- Rubrik
- SailPoint
Data
| Rubrik | SailPoint | |
|---|---|---|
| Q1 '25 | 48.7% | 22.8% |
| Q2 '25 | 51.2% | 33.1% |
| Q3 '25 | 48.3% | 19.8% |
| Q4 '25 | 46.3% | 22.7% |
| Q1 '26 | 39% | 21.6% |
| Q2 '26 | 37.9% | 16.8% |
| Q3 '26 | — | — |
The defense: demand is real, deployment is a multiyear cleanup
SailPoint President Matt Mills told buyers to "demand proof over promise" and "make us and every vendor you meet show you the cattle" 5. Accenture's Sanjeev Shukla says he has never met a client with least privilege fully employed, and that some tier-one banks sit at roughly 65% privileged access coverage after spending hundreds of millions of dollars 5.
As this publication reported on October 3, buyers reach for data-security platforms before identity vendors. Rubrik grew revenue 37.9% in the quarter ended July 31, 2026, while SailPoint grew 16.8% 67. The gap report SailPoint shipped on October 6 lands in the quarter neither company has reported yet.
Verdict watch: bookings, not surveys
The gap is real, and almost nobody has paid to close it. SailPoint's revenue growth cooled to 16.8% from 33.1% a year earlier 6, so the company selling the 40-to-1 warning is not yet collecting on it. A 40-to-1 gap is a TAM slide until somebody books it. Watch agent-security line items over the next four prints and whether that 2% figure moves; anything short of that leaves today's multiples underwriting a survey 1.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
