At RSAC 2026, the conversation around AI entered a new level of maturity.
The focus is no longer on experimentation. Now, it’s about how AI is operating inside enterprise environments and what it means for security when systems start acting on their own.
Agentic AI is now embedded across the business. It’s initiating actions, making decisions, and interacting across systems with increasing autonomy. These agents request access, execute workflows, and adapt in real time.
Once AI starts to act, identity becomes the control layer. And right now, that layer is under pressure.
The gap between confidence and control
One of the clearest signals—both at RSAC and in Delinea’s 2026 Identity Security Report—is how much confidence organizations have in their AI readiness.
On the surface, the numbers look strong. 87% of organizations say their identity security posture is prepared to support AI at scale. But that stat doesn’t tell the full story. Nearly half of the respondents (46%) acknowledge that their identity governance around AI systems is deficient.
This is the AI security confidence paradox in action. That tension was hard to miss at RSAC. Researchers highlighted persistent gaps in AI security, even in environments using the latest tools:
-
Agents that can modify their own security policies.
-
Lack of trust verification in agent-to-agent delegation—so-called agent swarms.
-
Abandoned “ghost agents” holding live credentials.
One example brought this into sharp focus: a highly autonomous AI assistant model, if compromised, could operate with user-level permissions across multiple systems. This shows how quickly risk can escalate when agents act independently, and identity controls and governance haven’t kept pace.
Identity is expanding faster than it’s being governed
AI agents are multiplying quickly. Non-human identities already outnumber human identities by as much as 82 to 1. Traditional Privileged Access Management (PAM) and governance models are not up to the task of securing identities at this scale.
This creates a growing visibility gap. 90% of organizations report gaps in identity visibility across their environment. That gap is most pronounced in AI-related contexts where identities are dynamic, and activity is harder to track in real time.
At RSAC, one message was repeated consistently: Organizations can’t control what they can’t see
This concept isn’t new, but it takes on entirely new meaning in the agentic AI era.
Today, more than half report regularly encountering unsanctioned AI tools or agents in their environment, and only 28% can detect that activity in real time. Meanwhile, 80% report they can’t always explain why a non-human identity performed a privileged action. Without that foundation, AI governance is just guesswork.
When speed becomes the priority
AI adoption isn’t slowing down, and neither is the pressure to keep up. Nearly 90% of organizations report pressure to loosen access controls to support AI-driven automation. In practice, that often means broader permissions, longer access durations, and more exceptions to keep systems running.
There’s awareness of this risk: 73% of organizations agree that standing access for non-human identities increases exposure. But speed wins more often than not. When agentic AI is operating continuously across systems, small compromises in access control don’t stay small for long.
Why nothing happening is the goal
This is exactly the shift Delinea’s Nothing happening is everything campaign is built around.
It reframes identity security as the invisible force that keeps the business in motion—ensuring the right identities have the right access at the right moment, so innovation, productivity, and agentic AI transformation can move forward without interruption.
In an environment defined by constant activity, effective security doesn’t create noise. It removes it, and quietly clears the path so:
-
Access is continuously verified.
-
Permissions are enforced in context.
-
Unauthorized access is stopped before it creates downstream risk.
That’s what identity security looks like at work—supporting growth, reducing friction, and enabling defensible access decisions, even as systems operate at machine speed.
From the outside, there’s no disruption. No escalation. No visible intervention. Nothing happens. Just security that powers business momentum.
Identity security at machine speed
Agentic AI is compressing the gap between decision and action, expanding access and increasing autonomy across every environment. That shift raises the stakes for stopping unauthorized access, consistently and at scale.
Organizations need to start with visibility, but that’s just the beginning. Security must operate at the same speed as the systems it protects, continuously validating access and governing how those systems are used in real time.
The organizations that get this right will win in the agentic AI era. From the outside, it looks like nothing is happening. And that’s the point.
REPORT
2026 Identity Security Report
