SailPoint used its Navigate stage in Austin on Tuesday to say something incumbents rarely say out loud: the old way of doing its own job doesn’t work anymore. “The idea that a security admin is going to review and approve access for a group of autonomous agents making 10,000 tool calls a second isn’t just outdated—it’s a fantasy,” said CTO Chandra Gnanasambandam (per SailPoint).
That’s an identity governance company admitting the access review, its oldest product, can’t keep up with agents. The answer it’s selling is more agents.
What shipped, and what didn’t. Three classes of Autonomous Agents that monitor runtime actions, intercept threats and right-size permissions. An expanded Agentic Fabric with shadow-AI discovery, runtime authorization and an agent kill switch. Just-in-Time provisioning with conditions for people, service accounts and agents. Agent Audit, which turns agent inventory into evidence reports for auditors. Those roll out starting at Navigate. The piece that closes the loop by itself, Autonomous ISPM, which finds dormant accounts, orphaned access and shadow admins and then fixes them, is expected in Q4 FY27, along with the Harbor Pilot Policy Agent and the Proofpoint integration. The Entro integration for secrets and credential lineage “will soon be complete.” Read the availability paragraph before you read the keynote.
The number they led with. SailPoint’s Horizons of Identity Security report says 79% of enterprises run AI agents in production and only 2% have deployed identity security built for them. It’s a vendor survey, so discount it. The direction still matches what buyers tell us: agents got deployed first and governed later.
Our POV. This is the incumbent counterattack in agent identity, and it changes the startup pitch. For a year, NHI and agent-security startups sold one easy line: your IGA tool can’t see agents. That line is harder now. Okta made the same move at Oktane in September with Agent SSO, agent-to-agent connections and a kill switch (per Okta). SailPoint followed with runtime authorization and remediation. Two of the biggest identity platforms now both claim the agent.
The money is still flowing to challengers. Reco raised $55M led by AT&T Ventures on September 29, bringing total capital to $140M (per Reco). Rig Security came out of stealth the same day with a $12M seed that included CrowdStrike’s Falcon Fund (per SecurityWeek). Both valuations: Undisclosed. Investors are betting the incumbents are slow. The incumbents are betting distribution beats speed. Distribution usually wins the budget line. Startups win the hard problems, or get bought.
Where SailPoint is strong. Context. It already knows who owns what, which roles are toxic together, and which accounts nobody certified. An agent is just another identity that acts faster. If SailPoint can tie every agent to a human owner and a business purpose, its kill switch can be surgical instead of blunt. That’s the pitch in its own words: stop the threat, save the good agents.
Where it’s weak. The runtime path. Governance tools have always acted on a schedule, through connectors. Blocking a bad tool call needs a hook in the path: an endpoint or browser sensor, a gateway, an MCP proxy. SailPoint names new endpoint and browser sensors plus SIEM and XDR telemetry, but frames them as discovery. Discovery isn’t enforcement. Ask where the block executes and how long it takes.
What we’d ask in the demo. Pick one production agent. Ask SailPoint to show its owner, every credential it uses and every tool it can call. Then revoke one permission and time how long until the agent actually loses it. Seconds, or a sync cycle? Ask what happens to a running agent when the kill switch fires. Does it drop mid-transaction and leave a half-written record? And ask which features in the demo are generally available today versus Q4 FY27. Put that answer in the contract, not the slide.
For analysts. In its fiscal second-quarter results last month, SailPoint said AI-driven ARR topped $70M and drove more than 30% of net new ARR in the quarter, on total ARR of $1.231B (per SailPoint). That’s the line to track. Navigate gives the sales team a bigger catalog. The next print will show whether agent governance shows up as dollars or stays a keynote. Pricing for the new agents: Undisclosed.