New research from SailPoint’s Horizons of Identity Security Report has found most Asia-Pacific organisations that have deployed AI agents are operating them without direct supervision, raising concerns about accountability and identity governance for non-human identities.
According to the report’s APAC findings, 95% of organisations running AI agents have them operating without supervision. It also found 85% of APAC enterprises are running AI agents in production, but only 5% have deployed security tools designed to govern what those agents can access and do.
The research points to what it describes as a gap between rapid AI adoption and controls to manage non-human identities, including AI agents that can access systems and hold credentials. SailPoint said 68% of APAC organisations are still relying on manual or ad hoc processes to manage non-human and AI agent identities.
The report also links the issue to tightening regulatory expectations, referencing Australia’s Privacy Act reforms and APRA CPS 234.
Nam Lam, Group Vice President, Australia and New Zealand at SailPoint, said:
“Business leaders are under pressure to drive growth through AI, but the data shows governance hasn’t kept pace. Most businesses in the region can’t say who owns a given agent, what it can access, or whether it’s still behaving as it should. That’s an urgent problem at this scale, because one agent operating outside its boundaries can do a lot of damage before anyone notices. ANZ enterprises need to treat agent ownership and oversight as a condition of deployment, not something to sort out afterwards. Organisations must discover every agent in their environment, automate its identity lifecycle and grant permissions only when required.”
The report also included global findings related to non-human identity security. It said 62% of worldwide organisations that have invested in securing non-human identities reported measurable productivity gains, and 76% of global leaders expect stronger identity governance to improve cyber insurance eligibility or terms.
Within APAC, SailPoint said 45% of organisations are still in the early stages of their identity security journey. The report also found only 30% of APAC enterprises have mature capabilities for detecting “shadow AI”, described as unsanctioned and ungoverned agent deployments.
