Executive summary

The agentic enterprise has arrived ahead of its security model. SailPoint’s fifth annual Horizons of Identity Security report, released 6 October, found that 79% of enterprises run AI agents in production while only 2% have deployed purpose-built security, describing a 40x gap between AI adoption and identity-security readiness. Microsoft’s 2026 Digital Defense Report, released 1 October, confirms that attackers still enter through people, identities and trusted access, and that AI agents are now a new attack surface. On 9 October, a compromised SDK for AI-agent infrastructure extended the Chain Drop supply-chain campaign into agent tooling. For banks and Fintechs wiring agents into payments, onboarding and operations, this is a control gap supervisors will not tolerate for long. The response is discipline, not a product: treat every agent as a non-human identity with an owner, a scope, a credential lifecycle and a tested revocation path.

Key statistic: Microsoft-reported figures in the 2026 Digital Defense Report put the average time before exposed cloud workloads were attacked at 5.3 hours, with data covering July 2025 to June 2026.

The development

Readiness. SailPoint’s survey of 340 senior identity, IT, cybersecurity and risk leaders found 79% running agents in production, 2% using tools designed specifically for agent identities, and just 4% reporting a fully modern identity stack. Okta’s CISO research points the same way: fewer than half of CISOs are confident they can identify all AI agents in their environment (47%), centrally control what those agents can access (46%) or authorize what individual agents can do (45%).

Threat model. Microsoft’s report examines agent identity, appropriate access, authentication between agents, attribution and the ability to revoke access, alongside AI-specific issues such as prompt injection, memory, models and data, and the integrity of software around AI systems. It stresses that identity and authorization, data protection, least privilege, monitoring and secure development all remain relevant; AI places those disciplines into new, more connected workflows.

Incident. Socket detected a compromised release of the tensorlake npm SDK, tooling for isolated sandboxes that run untrusted, LLM-generated code, carrying a credential-stealing, self-propagating worm that harvests secrets from local files, CI environments, Kubernetes and Vault sources. Chain Drop was first documented in August 2026 across hundreds of npm packages; the Tensorlake compromise extends it to AI-agent infrastructure.

The readiness numbers in one view:Summarizing AI agent governance risks and emerging identity solutions

Enforcement lives in the gateway, not in the prompt: prompt injection enters at the agent, but authority is granted and withdrawn by the system.

Human identity vs agent identity: where controls stand

Control	Mature for humans	State for AI agents	Required change
Discovery and inventory	HR-driven, complete	Most organizations cannot say how many agents are running or what decisions they make	Continuous agent discovery
Ownership	Line manager	Often absent	Named human owner per agent
Privilege model	Role-based, reviewed	Standing, over-scoped	Zero standing privilege, just-in-time access
Credentials	SSO, MFA, rotation	Embedded secrets in code and CI	Vaulted, short-lived, non-exportable
Attribution	Audit log per user	Ambiguous across agent chains	Identity binding for every action
Revocation	Offboarding workflow	Ad hoc	Instant, tested disable path

Industry impact

Agent governance is becoming a buying criterion in cloud and identity procurement rather than an add-on. Identity vendors are repositioning around it, cloud providers are embedding identity into agent runtimes, and the ability to disable a compromised agent quickly is becoming the test of whether an incident can be contained.

Insight: The breach pattern has not changed; attackers still enter through identities and trusted access. What has changed is the number of identities, and how many of them are software identities acting at machine speed.

Banking and FinTech Relevance

1. Agents are reaching money movement. Huntington Bank introduced the 1866 Studio on 19 October, an AI-powered small-business operating system built with Google Cloud, one example of agents moving from back office into customer-facing finance. The September ITS article on agentic payments covered the commercial side; this is the control side.
2. Supervisors already treat non-human identities as in scope. DORA’s ICT-risk requirements and GCC central-bank outsourcing and cyber frameworks apply to any software acting on systems of record. An agent with unattributed authority is an audit finding waiting to happen.
3. Credential theft is the dominant fraud precursor. Microsoft reported that 63% of intrusions involved data theft and that more than 46 million business-email impersonation attacks were detected in 12 months; agents holding embedded secrets widen that door.
4. For Fintechs selling into banks, demonstrable agent inventories, scoping and revocation will become integration prerequisites.

Enterprise implications and opportunities

• Inventory first. Agents cannot be governed until they are counted.
• Assign owners and scopes with the same rigor applied to privileged service accounts.
• Harden the agent supply chain. Teams using Tensorlake were advised to check dependency manifests, lockfiles, build logs and deployed artefacts for the compromised version; the same hygiene applies to every agent SDK.
• Design for denial. Policy engines and gateways, not prompts, must be able to end an attempt.
• Plan for recovery. Veeam’s 15 October analysis argued that backup and recovery remain the neglected piece of agentic-era security.

Risks and challenges

• Velocity vs control. Business units deploy agents faster than security can onboard them.
• Survey bias. The most-cited statistics come from identity vendors with products to sell; they are directional, corroborated by incident data rather than proven by it.
• Agent-to-agent chains blur accountability and complicated forensic reconstruction.

Outlook

Expect agent identity to become a standard category in identity platforms within 12–18 months, explicit supervisory guidance on non-human identities in financial services, and intensifying supply-chain attacks on agent tooling. The upside is measurable: SailPoint’s data suggests mature organizations are twice as likely to realize significant productivity gains and three times more successful at deploying AI safely.

Executive takeaways

1. Count your agents; board reporting should show the number in production, their owners and their privilege level.
2. No standing privilege for software: short-lived, scoped credentials issued per task.
3. Put enforcement in the system, not the prompt.
4. Treat agent SDKs as critical third-party software with core-banking-grade supply-chain controls.
5. Make agent governance a procurement criterion for every cloud, identity and FinTech vendor.