91% of Organisations Now Use AI Agents — But Okta's 2026 Report Reveals a Critical Identity Security Gap

The AI Agent Adoption Surge Has Created an Unexpected Security Crisis

Okta's newly released Businesses at Work 2026 report delivers a stark message: whilst 91% of organisations now deploy AI agents across their operations, identity and access management systems have failed to keep pace. This isn't a future problem — it's happening right now, and the security implications for UK businesses are profound.

The research, published this week, reveals that the breakneck speed of AI agent adoption has outstripped the evolution of identity security frameworks designed for human users. As AI agents proliferate across finance, HR, customer service, and operations, they're operating with access privileges that organisations don't fully understand or control.

What Okta's Research Actually Found

The Businesses at Work 2026 report surveyed thousands of organisations globally and uncovered several critical findings:

AI agent adoption is universal. 91% of organisations report active AI agent deployment — not pilots or experiments, but production systems handling real business processes. This represents a seismic shift from just 18 months ago when AI agents were largely experimental.

Identity systems weren't built for this. Traditional identity and access management (IAM) frameworks assume human authentication patterns: password resets, MFA challenges, session timeouts based on working hours. AI agents operate 24/7, make thousands of API calls per hour, and don't fit these models.

The identity gap is widening. Whilst human identity management has matured over two decades, AI agent identity protocols are ad hoc at best. Most organisations admit they don't have clear policies for:

• How AI agents authenticate to systems
• What data AI agents can access
• How to audit AI agent actions
• When to revoke AI agent permissions
• How to detect compromised AI agents

Compliance risk is mounting. With GDPR, UK data protection laws, and sector-specific regulations, organisations are legally responsible for AI agent actions. Yet many can't definitively answer who approved specific AI agent access or what data an agent has touched.

Why This Matters for UK Businesses Right Now

This isn't abstract security theory. The identity gap creates immediate, tangible risks for UK organisations:

Regulatory Exposure

The ICO has made clear that automated systems — including AI agents — don't absolve organisations of data protection responsibilities. If an AI agent accesses customer data inappropriately, the organisation faces the consequences. Without proper identity controls, you can't prove compliance.

Operational Risk

AI agents with excessive permissions can cascade errors across systems. A misconfigured agent in your CRM could update thousands of customer records incorrectly, trigger automated communications, or expose sensitive data. Traditional access controls would limit the blast radius; the identity gap removes these guardrails.

Supply Chain Vulnerabilities

Many UK businesses use AI agents from third-party platforms — workflow automation tools, AI-powered CRMs, voice AI systems. Each represents a potential entry point. If you can't manage these agents' identities centrally, you've created multiple security blind spots.

Audit Trail Gaps

When human employees access systems, you have login records, session data, and clear attribution. AI agents often operate through service accounts or API keys that multiple agents share. If something goes wrong, can you definitively trace which agent did what, when, and why?

The Technical Reality of AI Agent Identity

Understanding why this gap exists requires looking at how AI agents actually operate:

AI agents aren't users. They don't log in through a browser. They authenticate via API keys, service accounts, OAuth tokens, or embedded credentials. Traditional IAM systems struggle to classify and manage these non-human identities.

AI agents operate at machine speed. A human might make 50 system interactions per day. An AI agent can make 50,000. Standard anomaly detection flags this as suspicious, creating alert fatigue or forcing security teams to whitelist entire categories of behaviour.

AI agents need different permissions. Role-based access control (RBAC) assumes relatively static job functions. AI agents might need broad read access to synthesise information but restricted write access. They need permissions that shift based on context, not just role.

AI agents multiply rapidly. Organisations that deployed one or two AI agents six months ago now run dozens. Each new agent compounds the identity management challenge, and many are deployed by business units without central IT oversight.

What UK Businesses Should Do Immediately

Okta's research doesn't just highlight the problem — it points toward practical steps:

1. Inventory Your AI Agent Landscape

You can't secure what you don't know exists. Conduct an immediate audit:

• Which AI agents are running in production?
• What systems do they access?
• How do they authenticate?
• Who approved their deployment?
• What data can they read or modify?

Many UK businesses discover they have 3-5 times more AI agents than they realised, often deployed through SaaS platforms or workflow automation tools.

2. Establish AI Agent Identity Policies

Create explicit policies that address:

• Authentication standards — API keys must rotate regularly, service accounts require MFA where possible, OAuth tokens have defined scopes
• Least privilege access — AI agents get minimum permissions needed for their function, nothing more
• Approval workflows — New AI agent deployments require security review, not just business approval
• Lifecycle management — Clear processes for provisioning, monitoring, and deprovisioning AI agents

3. Implement AI Agent-Aware Monitoring

Traditional SIEM tools need configuration updates:

• Create baselines for normal AI agent behaviour
• Alert on privilege escalation attempts
• Monitor for unusual data access patterns
• Track API rate limits and throttling
• Log all AI agent actions with sufficient detail for forensic analysis

4. Segregate AI Agent Access

Where possible, create separate authentication paths for AI agents:

• Dedicated service accounts with clear naming conventions
• Separate API gateways with agent-specific rate limits
• Isolated credentials that don't overlap with human access
• Network segmentation that limits lateral movement

5. Plan for the Agentic Future

This is just the beginning. Okta's research suggests AI agent numbers will double again in the next 12 months. Your identity architecture needs to scale:

• Evaluate identity platforms that explicitly support non-human identities
• Consider implementing machine identity management solutions
• Build relationships with vendors who understand AI agent security
• Train your security team on AI agent-specific threats

The FlairCross Perspective: Integration Is Where Identity Gaps Appear

We see this identity gap daily in our automation and integration work. When we connect n8n workflows to HubSpot, integrate voice AI with business systems, or build custom AI agents for clients, identity management is where things get complex fast.

The organisations that handle this well share common traits:

They design identity controls from the start. When we scope an automation project, security-conscious clients ask "how will this authenticate?" before asking "what will this do?" That's the right instinct.

They maintain a single source of truth. Whether it's an identity provider like Okta, Azure AD, or even a well-managed credential vault, they have one place where all authentication — human and AI — is centrally managed and audited.

They test failure scenarios. What happens if an API key is compromised? What if an AI agent goes rogue? They've actually tested these scenarios rather than assuming they'll figure it out during an incident.

They treat AI agents as first-class security concerns. Not afterthoughts, not exceptions to policy, but entities that receive the same security scrutiny as privileged human accounts.

The Compliance Clock Is Ticking

Okta's research arrives at a critical moment for UK businesses. Regulators are beginning to ask pointed questions about AI governance, and "we didn't think about AI agent identity" won't be an acceptable answer.

The ICO has already indicated that automated decision-making systems require clear accountability trails. The FCA expects financial services firms to manage AI risks with the same rigour as other operational risks. Industry-specific regulations increasingly reference AI systems explicitly.

The organisations that close the identity gap now will have a significant advantage: they'll be able to deploy AI agents confidently, scale them rapidly, and demonstrate compliance clearly. Those that don't will face a choice between limiting AI adoption or accepting unquantified risk.

Key Takeaways for UK Business Leaders

The identity gap is real and immediate. 91% of organisations use AI agents, but identity management hasn't caught up. This creates security, compliance, and operational risks that demand attention now.

Traditional IAM doesn't cover AI agents. Your existing identity infrastructure was built for humans. AI agents authenticate differently, operate at different speeds, and need different permission models.

This is solvable with deliberate action. The gap isn't inevitable. Organisations that inventory their AI agents, establish clear policies, implement appropriate monitoring, and plan for scale can manage AI agent identity effectively.

Integration is where risks materialise. When AI agents connect to your CRM, ERP, financial systems, and customer databases, identity controls are your primary defence. Get this wrong and the consequences multiply across every connected system.

The window for proactive action is closing. As AI agent adoption accelerates, the organisations that address identity gaps early will deploy AI faster and more safely than those scrambling to retrofit security.

If you're deploying workflow automation, AI agents, or integrations that connect business systems, the identity question isn't optional. It's foundational. And the time to address it is before an incident forces your hand.

Need help auditing your AI agent landscape or designing identity controls for your automation strategy? Get in touch — we specialise in building secure, scalable integrations that treat identity as a first-class concern.