The Identity Security Control Plane for the AI Agent Era

Core Conclusions

• Once AI agents go mainstream, identity security is no longer only about "employee login" and "customer authentication." It is elevated into an "identity control plane" that unifies humans, workloads, service accounts, API keys, OAuth apps, certificates, short-lived tokens, CI/CD pipelines, bot accounts, and AI agents. Microsoft, AWS, Google Cloud, GitHub, and the MCP spec itself already treat workload identity, federation, OAuth scopes, and resource audience validation as infrastructure rather than as add-on features.

• Non-Human Identity now extends far beyond traditional "machine certificates" or "service accounts." In practice it covers service principals, Kubernetes service accounts, cloud roles, CI/CD OIDC tokens, API keys, SSH keys, certificates, secrets, OAuth apps, SaaS-to-SaaS connectors, RPA accounts, automations, MCP servers, AI agents, and agent-to-agent delegation chains. Microsoft, Google, AWS, Veza, Okta, and CyberArk have all explicitly modeled or productized these objects.

• AI agents substantially amplify identity risk—not merely because there are "more accounts," but because they can autonomously call tools, read data across systems, run continuously at machine speed, propagate privileges along delegation chains, and stack prompt injection, tool poisoning, OAuth consent, token theft, overprivilege, and audit gaps onto a single execution chain. The MCP spec already requires the resource parameter and token audience validation and explicitly prohibits token passthrough, which shows that the protocol design layer has acknowledged this risk.

• The first identity-security budget to land will not be a "pure agent-identity platform" itself, but four more easily procured and already-mature budget pools: PAM, machine identity management, secrets management, and extension modules for IGA/ITDR/CIEM. The reason is that these budgets already exist, the buyers are clearly defined, the compliance drivers are strong, and they map most directly to incident accountability and audit requirements. CyberArk, SailPoint, Okta, HashiCorp/IBM, and JFrog have already produced quantifiable commercial signals in these adjacent areas.

• The real direct beneficiaries are not every company telling an "AI security story," but the companies that have already turned identity, entitlements, secrets, certificates, authorization, and audit into platform SKUs, expanded ARR, or driven RPO/cRPO. The group with the strongest current evidence is CyberArk, SailPoint, Okta, Microsoft Entra, IBM/HashiCorp Vault, and JFrog; CrowdStrike, Cloudflare, Cisco, Zscaler, and Palo Alto Networks are more at the stage of "platform enhancement with financial contribution not yet broken out."

• Identity security will most likely become the security control plane of the AI agent era, but the premise is not "SSO matters more"—it is that "identity graph + authorization graph + secrets/cert lifecycle + runtime policy + audit trail" become unified. Single-point SSO/MFA vendors that cannot extend into NHI, runtime authorization, data entitlements, and human-in-the-loop governance will see their platform standing decline.

• Pure NHI/agent-identity startups are a genuine threat, not a marketing gimmick. Aembit, Oasis, Entro, Astrix, Veza, SGNL, Reco, Valence, and Grip are all rebuilding the budget entry point around "discover—attribute—entitle—continuously authorize—audit." Cisco's planned acquisition of Astrix and CrowdStrike's acquisition of SGNL show precisely that the large platforms recognize this direction as a next-generation control-plane entry point rather than a minor feature.

• The segments with the greatest revenue elasticity, in priority order, are: PAM extending into NHI/agents, machine identity management, secrets management and developer token security, IGA extending into NHI ownership/attestation, and data access governance/RAG permission control. MCP tool authorization and agent runtime authorization carry high technical importance, but their commercialization remains relatively early.

• The segments with the best margins are usually not "security consulting" or "single-point detection," but the software layers embedded in workflows and seated on the control plane: PAM, IGA, identity graph, policy engine, secrets vault, and certificate lifecycle automation. By contrast, MCP observability, point OAuth monitoring, and point secrets scanning are easily absorbed by platforms, unless they occupy a unique system-level data entry point.

• The most bubble-prone valuations are not the traditional IAM leaders, but the high-growth platform stocks and startups with "a strong agent-security narrative but revenue not yet broken out." Cloudflare, CrowdStrike, Palo Alto Networks, and Zscaler already have a clear AI-security premium embedded in their share prices, while expectations for AI identity security at SailPoint, IBM/HashiCorp, and some more infrastructure-oriented software companies are, conversely, not fully priced in.

• Public cases that already show clear "revenue-landing signals" include: SailPoint FY26 ARR of $1.125 billion with SaaS ARR up 38% year over year; CrowdStrike ending FY26 with ARR of $5.25 billion and folding SGNL revenue into a larger identity-and-continuous-authorization narrative; JFrog FY25 Security Core already at 7% of revenue, 10% of ARR, and 16% of RPO; Okta FY26 Q4 RPO up 15% and cRPO up 12% year over year. All of these matter more than "shipping an agent-security feature."

• One must be careful not to mistake "enhanced identity-security defense" for "a new growth curve." Palo Alto Networks, Zscaler, Cisco, Trend Micro, Check Point, and many Chinese integrated-security vendors currently look more like they are using identity and AI-security capabilities to harden existing platforms, rather than having already formed an independently verifiable new revenue pool. In public materials, related product launches clearly outnumber standalone revenue disclosures.

• Cloud providers' squeeze on foundational capabilities is a real risk. AWS, Azure, GCP, Oracle, Alibaba Cloud, and Tencent Cloud have all made IAM, workload identity federation, temporary credentials, secrets manager, and policy analysis into built-in capabilities, so single-cloud secrets, single-cloud CIEM, and basic certificate/key tooling will keep commoditizing. What can still hold a profit pool is cross-cloud, cross-SaaS, cross-directory, cross-data-plane ownership, least privilege, runtime enforcement, and unified audit.

• The four biggest catalysts over the next 12–24 months are: GA of Microsoft Entra Agent ID, GA of Okta for AI Agents, progress on CyberArk Secure AI Agents and the Venafi integration, and platformization acceleration after deals like Cisco/Astrix and CrowdStrike/SGNL. The biggest risk is that enterprise agent adoption lags expectations, pushing back "pure agent identity" budgets while real-world procurement keeps prioritizing secrets, PAM, and data governance.

The Value-Chain Landscape and Budget Migration

From Human Identity to Non-Human Identity

What enterprises face today is not the single identity problem of "a person logging into a system through a browser," but software entities calling one another at massive scale. AWS explicitly defines an IAM identity as something that can represent either a human user or a programmatic workload; IAM Roles Anywhere further turns X.509 certificates into an entry point for temporary cloud credentials. Google Cloud's Workload Identity Federation lets external workloads obtain IAM permissions directly, without relying on long-lived service account keys; GitHub Actions encourages using OIDC tokens in place of long-lived secrets. Microsoft goes further by defining workload identities as software entities such as apps, services, scripts, and containers, and stresses that such identities usually cannot perform MFA, often lack a formal lifecycle process, and must store their credentials somewhere. In other words, NHI is not a new problem—rather, identities "hidden inside DevOps, cloud, SaaS, and automation" are beginning to surface en masse in the AI agent era.

AI agents turn this problem from a "hidden cost" into "the main security battlefield." An agent is not a pure API caller; it needs to read enterprise knowledge bases, access mailboxes and ticketing systems, trigger SaaS workflows, drive a browser or RPA, request tokens, use MCP tools, chain to other agents, and in some scenarios run with delegated authority "on behalf of a user." Ping Identity publicly defines Identity for AI as treating AI agents as first-class non-human identities and requiring delegated authority, least privilege, comprehensive audit, and human-in-the-loop approvals; Microsoft Entra Agent ID places sponsor, access packages, agent lifecycle, OAuth 2.0, MCP, and A2A within a single framework.

MCP raises identity and authorization complexity by another notch. The MCP Authorization spec requires the client to carry the resource parameter in authorization and token requests, requires the server to verify that the token was issued specifically for that resource, and explicitly prohibits token passthrough; Anthropic's Claude Code documentation further requires pinning the allowed scopes to the subset approved by the security team via oauth.scopes. In other words, an MCP tool call is not "one more plugin"—it chains OAuth, resource server, scope governance, tool permission, session storage, and agent approval onto a single execution path.

The Full Map of AI Identity Security Demand and Monetization

The investment implication behind this table is clear: what buyers should focus on most are not companies that "have an agent-security page," but those that already hold strong paying control points such as IGA, PAM, secrets, machine identity, runtime authorization, or data entitlements. The closer to "pre-execution authorization" and "auditable delegation chains," the greater the revenue elasticity tends to be; the closer to single-cloud foundational capabilities, the more easily it is swallowed by cloud providers' built-in offerings.

How AI Agents Change Identity-Security Budgets

The logic of budget migration can be summed up in one sentence: agents turn the hidden identity costs once scattered across IAM, PAM, DevOps, CloudSec, DataSec, and SaaS management into a procurable, auditable, and accountable control-plane budget. This migration will not happen overnight, but the direction already appears in official products and customer documentation: in its Q1 2026 earnings, Cloudflare stated outright that agents have become a core part of its workforce; Okta makes "agentic AI readiness is identity readiness" a 2026 enterprise signal; Microsoft, Ping, and CyberArk all launched agent identity as a formal product line in 2025–2026.

AI coding and software automation will lead by driving budgets for secrets, developer tokens, and CI/CD identities. GitGuardian counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34% year over year, with AI-service leaks up 81%, and AI-assisted commits roughly twice as likely to leak secrets as non-AI commits; GitHub, Google, and Azure now all encourage migrating workflows from long-lived secrets to OIDC and federation. This means the first wave of budget is not a "mysterious agent-security platform," but the more concrete secret scanning, vaults, ephemeral credentials, developer token policy, and pipeline identity hardening.

RAG and enterprise knowledge bases will push data entitlement governance further to the front. According to research published by Cyera, 96% of enterprise permissions are in practice long unused, and AI agents will not, like humans, be "too lazy to open some resource"; once granted permissions, they may bulk-read, correlate, and export within milliseconds. BigID likewise merges DSPM, Data Access Governance, and AI SPM into a single integrated narrative, stressing that the core question is "what sensitive data exists, who can access it, and whether the access is excessive." So while data access governance is not a traditional core IAM budget, in the second phase after agents go live it may well become a large incremental pool for identity security.

Three Scenario Forecasts

The base scenario is the most reasonable assumption at present. The reason is not that every enterprise will quickly deploy fully autonomous agents, but that the moment enterprises use agents in places that "can operate real systems and real data," least privilege, delegation, human approval, tool authorization, secret rotation, and audit trail shift from "security recommendations" to "go-live prerequisites." That is why budgets will flow first to mature control points and then spread to the pure agent-identity layer.

Architecture Layers and Segment Value Breakdown

Typical Architecture of an Enterprise-Grade AI Agent Identity Security System

A deployable enterprise-grade AI agent identity security system typically comprises fifteen layers: agent discovery, NHI inventory, lifecycle, authentication, authorization/policy, least privilege, JIT/ZSP, secrets & certificates, API/MCP access control, RAG/data entitlements, ITDR, session/audit, human approval, compliance reporting, and SOC/SIEM integration. What is truly worth researching now is which of these layers are most likely to form a moat, and which will be swallowed by built-in offerings.

The strongest long-term moat is the entire bundle of NHI/agent inventory + authorization graph + least-privilege/JIT + secrets/cert lifecycle + audit trail, not any single feature point. Product roadmaps such as Microsoft Entra Agent ID, CyberArk AI Agent Gateway, Ping Identity for AI, SGNL, and Cloudflare MCP Portals are all converging in this direction: first give the agent an identity, then an owner, then a scope, then a revocable and auditable execution surface.

Deep Breakdown of Segments

The table below compresses the thirty segments you listed into the judgments that matter most from an investment perspective. Scores are 1–5, with 5 highest.

The single point most worth stressing is this: MCP Tool Access Governance and Agent Runtime Authorization are extremely important, but they are not yet the most certain revenue pools; instead, PAM, secrets, machine identity, and IGA extensions look more like the "real-world receiving layer" that catches this wave of budget. From an investment-timing standpoint, this means one should not fixate only on "the most cutting-edge new buzzwords," but should first find companies that can embed cutting-edge demand into mature budget line items.

Company Map and Investment Tiering

Master Table of Direct Beneficiaries, Platform Beneficiaries, Challengers, and Pseudo-Beneficiaries

Which Companies Have a Strong Narrative but Insufficient Financial Validation

There are currently three typical combinations of "strong narrative, insufficiently broken-out financials." The first is the large platform-security vendors: Cloudflare, Palo Alto Networks, Cisco, Trend Micro, and others have shipped MCP, agent lifecycle, AI security, identity-first, and similar features, but their public financials are still disclosed mainly at the larger platform level, making it hard to prove that AI/NHI identity subproducts have formed standalone ARR. The second is the high-buzz startups: Aembit, Oasis, Entro, Valence, Grip, Noma, and Lasso are in the right direction, but their public revenue/ARR disclosures are very limited. The third is regional integrated-security companies, especially Chinese vendors and some Japanese/Korean/Indian integrated-security firms or service providers; they may benefit at the margin from projects and defense demand, but public materials rarely break out NHI, agent identity, or MCP governance as verifiable revenue items.

The Private-Market Watchlist Most Worth Tracking

Key Listed-Company Research and Scoring

Listed Companies Most Worth Further Research

The table below compresses the listed companies most worth deeper digging into the few dimensions buyers care about most: segment position, revenue exposure, margin impact, valuation observation, and research conclusion.

Five Tiers and Investment Priority

Tier A: core direct beneficiaries of AI/NHI/agent identity security CyberArk, SailPoint, Microsoft, Okta, IBM/HashiCorp, JFrog. Their common trait is that the identity control plane is not an ad slogan but is already bound to chargeable, expandable, and auditable product layers such as PAM, IGA, Vault, developer security, directory, or cloud access.

Tier B: clear beneficiaries, but coexisting with valuation, competition, or platform-squeeze risk CrowdStrike, Cloudflare, Zscaler. All can benefit from the agent era, but they rely more on the "large security platform" absorbing value than on identity subproducts monetizing standalone; at the same time, their current market pricing is already fairly optimistic.

Tier C: more defensive tools, with weak near-term financial elasticity Palo Alto Networks, Cisco, Oracle, Trend Micro, Alibaba Cloud, Tencent Cloud. All need to round out their identity capabilities, or the platform will lose ground; but near term they look more like "defending platform competitiveness" than an independent, high-elasticity new profit pool.

Tier D: strong AI-identity-security narrative, but still insufficient evidence of actual benefit Most pure agent-security or broad AI-security startups, plus some regional integrated-security vendors. The issue is not the product direction, but that public revenue, ARR, retention, and customer penetration are not yet enough to support a secondary-market-style high-certainty judgment.

Tier E: single-point tool companies or segments with high platform-consolidation risk Single-cloud secrets, single-point certificate tools, point CIEM, point OAuth monitoring, secrets tools that only do static scanning, and traditional identity products that only do SSO/MFA. Both cloud providers and platform vendors are pushing down into these features.

Scoring Model and Results

This report uses the following total-score model to assign subjective scores on a 100-point scale to the key companies:

• Direct revenue exposure to AI/NHI/agent identity security: 25%

• Platform position and customer base: 20%

• Identity data and technical moat: 15%

• Product breadth and integration capability: 15%

• Financial quality and margins: 10%

• Growth elasticity: 10%

• Valuation reasonableness: 5%

A reverse risk model is also used to assess "risk of being consolidated by an identity platform":

• Risk of the core business being consolidated by a platform: 30%

• Single-point-tool nature: 20%

• Lack of data/platform/ecosystem moat: 20%

• Risk of budget being squeezed by cloud providers or large platforms: 15%

• Risk of overvaluation: 15%

The core of this scoring is not "who has the flashiest technology," but who is most likely to turn the NHI, tool authorization, runtime privilege, ownership, and data entitlements brought by AI agents into recurring ARR. By this standard, CyberArk, SailPoint, Microsoft, and Okta clearly rank ahead of most integrated-security platforms that "tell a good AI-security story but do not break out revenue."

Valuation, Risks, and Final Conclusions

Which Expectations Are Already Priced In, and Where Gaps Remain

Looking at market data as of May 19, 2026, the valuations of CrowdStrike, Cloudflare, Palo Alto Networks, and Zscaler already clearly include an AI-security and platformization premium. CrowdStrike's market cap is about $155.5 billion, a very high implied multiple to FY26 revenue of $4.81 billion; Cloudflare's market cap is about $71.1 billion, while its Q1 2026 single-quarter revenue is only $639.8 million; Palo Alto Networks trades at a P/E of about 136x, while Cloudflare, Zscaler, GitLab, and JFrog still sit in a negative-GAAP-P/E framework. In other words, these companies can indeed benefit, but their "benefit logic" and "valuation appeal" have already clearly diverged.

The relative expectations gaps lie with companies that have already formed a real identity-security revenue pillar but that the market has not yet fully re-rated as an "AI identity control plane." SailPoint is the most typical case: it has already written unified governance of AI agents, machines, and identities into its official narrative, with FY26 ARR reaching $1.125 billion; yet as of 2026-05-19 its market cap is only about $8.13 billion. IBM/HashiCorp is similar—Vault's infrastructure nature in secrets, PKI, and workload identity is very strong, but capital markets view it more through the lens of IBM as a whole, rather than pricing Vault separately as a control-plane asset under the agent explosion.

Representatives of "good company but valuation too expensive" are CrowdStrike, Cloudflare, Palo Alto Networks, and parts of Zscaler; representatives of "real revenue growth, valuation still researchable" are SailPoint, JFrog, and IBM/HashiCorp; representatives of "strong narrative but insufficient financial validation" include most AI-native agent/NHI startups and some newly launched AI-identity modules from large platforms.

Systemic Risks

The biggest fundamental risk is not that "identity security does not matter," but that enterprise agent adoption proceeds slower than the market imagines. If agents stay at the stage of Q&A, summarization, and code suggestions and do not truly plug into production systems, knowledge bases, ticketing flows, and automated approval chains, then the first to benefit will still be data security, foundation models, and cloud compute—not agent-identity-specific budgets. For pure agent-identity startups, this is especially critical.

The second risk is cloud providers pushing down. Microsoft, AWS, GCP, Oracle, Alibaba Cloud, and Tencent Cloud have already demonstrated enough built-in capability to compress the room for single-cloud secrets, basic workload identity, basic CIEM, and some certificate/credential management tools. Independent companies that lack cross-cloud, cross-SaaS, cross-data-layer unified ownership, policy, audit, and entitlement graph are easily marginalized.

The third risk is that standards are not yet stable. Although MCP security best practices and the authorization spec have taken shape, enterprises' governance approaches for MCP servers, tool-call authorization, cross-agent delegation, and approval semantics are still iterating fast. Betting too early on "one specific implementation" carries product-path risk.

The fourth risk is deployment complexity and business friction. The deeper identity security goes into runtime policy, ZSP, data entitlements, and human approval, the more it runs into business-process change, developer-productivity tradeoffs, audit workflows, and organizational responsibility boundaries. This lengthens sales cycles and raises customer-education costs.

Final Conclusions

Identity security and NHI's position in the AI value chain has already been upgraded from a "supporting security feature" to a prerequisite control layer for enterprise AI agents to truly land. Without independent identity, explainable permissions, short-lived credentials, tool authorization, and an auditable delegation chain, an agent can only stay at the demo stage; once an enterprise lets an agent truly touch production data and production systems, the identity control plane becomes a go-live prerequisite.

The five segments most worth watching are: PAM extending into NHI/agents, machine identity management, secrets/developer token security, IGA/NHI governance, and data access governance/RAG permissions. Together these five segments cover the six core questions of "who is executing, what can they do, where do the credentials come from, is there overprivilege, what data was accessed, and can it be held accountable."

The ten listed companies most worth deep research are: CyberArk, SailPoint, Microsoft, Okta, IBM, JFrog, CrowdStrike, Cloudflare, Zscaler, and Palo Alto Networks. Of these, the first six lean toward "control plane and revenue landing," while the last four lean toward "platform absorption and valuation elasticity."

The ten private companies most worth tracking are: Veza, Saviynt, Ping Identity, Delinea, BeyondTrust, Aembit, Oasis Security, Entro Security, Astrix Security, and Reco. Among them, the Veza/Astrix/SGNL path best embodies the M&A value of "unified authorization graph + runtime enforcement"; Aembit, Oasis, and Entro are more like the purest NHI-native objects to watch; Reco, Valence, and Grip represent another evolutionary path for SaaS/OAuth/Shadow AI identity risk.

The five points the market most easily misunderstands are: First, agent identity does not equal giving an agent an account; what truly matters is delegated authority, ownership, approval, and runtime authorization. Second, NHI is not a new species, but an identity surface that has always existed yet gone ungoverned. Third, MCP security is not a prompt problem, but an OAuth, resource server, scope, and tool authorization problem. Fourth, the first to make money will not be the "agent-security story," but PAM, secrets, machine identity, and IGA extensions. Fifth, identity security will become the control plane, but not with SSO dominating alone—rather as the union of identity graph, authorization graph, credential lifecycle, and data entitlements.

The metrics most worth tracking over the next 6–12 months are not a generic "AI revenue," but: CyberArk's machine-identity and AI-agent-related ARR and customer cases; SailPoint's SaaS ARR and NHI/AI governance penetration; Okta's AI Agents customer count and RPO/cRPO; the customer-adoption pace of Microsoft Entra Agent ID; CrowdStrike's integration of SGNL and FalconID penetration; the commercialization pace of Cloudflare's MCP/Zero Trust AI products; JFrog Security Core's share of revenue and RPO; and whether major identity-abuse incidents clearly involve agents, OAuth apps, tool abuse, or out-of-control delegation chains.

For narrower, deeper follow-on research directions, I suggest focusing on: NHI Security, Agent Runtime Authorization, PAM extending into agents/NHI, Secrets Management, Certificate Lifecycle, CIEM and Cloud Entitlements, RAG Permission Control, and MCP Tool Authorization. This is the intersection that currently comes closest to overlapping "real revenue landing" and "future control-plane moat."

This report is based on public information and does not constitute investment advice. Markets carry risk; invest with caution.