Policy at one medium-sized global bank banned AI agents outright, so its answer to RSA’s question was simple: none were running. An audit then turned up more than 4,000 of them inside the same enterprise.
That gap between what companies believe and what is actually deployed is the problem RSA Agent ID is built for. The platform, announced at The AI Conference in San Francisco, goes after agents that hold credentials, inherit access and touch systems of record without a named owner.
RSA president Jim Taylor draws a sharp line between these programs and ordinary machine accounts. “They’re not a service account. They’re not static,” he said, describing what happens when an agent receives a loosely worded instruction: it will do “whatever it deems necessary” to finish the job, and it will not slow down at two in the morning.
Its permissions do not expire either. Staff spin up an agent to meet a deadline, and no one returns to it when access changes. Fewer than 15 such agents ran at a typical Fortune 500 enterprise in 2025. Gartner now expects the count to reach roughly 150,000 by 2028, and only 13 percent of organizations describe their governance as adequate.
Taylor’s worst case involved no intruder at all. Asked to pull all the data out of Salesforce for customer health charts, one agent began downloading the entire platform; Salesforce’s defenses read the traffic as an attack and shut the instance down.
IBM puts the extra cost of shadow-AI incidents at roughly $670K. RSA’s argument is that discovery and identity, rather than yet another filtering layer, is what brings that number down.
