ConductorOne released its third annual Future of Identity Report, based on a survey of 508 IT and security leaders from U.S. organizations with more than 1,000 employees.
The Future of Identity Report findings point to a structural shift in how enterprise systems operate. AI agents are no longer experimental tools. They are now performing operational work across IT and security environments, often with direct access to enterprise systems.
The report found 95% of organizations now run AI agents that autonomously perform IT or security tasks, marking a rapid shift from experimentation to production in less than a year. At the same time, identity governance models designed for human approval workflows are struggling to keep pace with AI-speed operations, creating new security and governance gaps as autonomous systems gain access to enterprise tools and data.
Key findings from the 2026 Future of Identity Report
AI agents are now operating autonomously across the enterprise. 95% of organizations report AI agents performing IT or security tasks autonomously, compared to 96% that said they planned to operationalize agents just one year ago.
Identity-related breaches remain widespread. 80% of organizations experienced at least one identity-related breach in the past year, with phishing and social engineering (52%) and malware or ransomware (46%) leading attack vectors.
Non-human identities are rapidly outnumbering human users. 47% of organizations report more non-human identities than human users, yet only 22% say they have full visibility into those identities.
IAM investment is accelerating in response to AI adoption. 91% of organizations increased IAM spending, signaling that identity security is becoming a foundational control as autonomous systems expand.
The Rise of the Agentic Enterprise
The report highlights the emergence of the agentic enterprise, where autonomous software entities perform work alongside humans by operating through identity and delegated access.
Thirty-one percent of respondents say their organizations are already operating in this model today, while another 32% report early agentic workflows in production. An additional 25% are actively piloting AI agents for operational tasks.
“The next wave of AI adoption will not be driven just by engineering teams,” said Alex Bovee, CEO and co-founder of ConductorOne. “It will be driven by every employee connecting personal AI assistants to enterprise systems. When thousands of users are delegating real work to autonomous agents, you need identity infrastructure that governs which tools an agent can reach, what operations it can perform, and whose authority it acts under. Without that, you do not have an AI strategy. You have an access control crisis.”
Identity Sprawl Expands the Security Surface
The rapid growth of service accounts, API keys, automation workflows, and AI agents is expanding the enterprise identity surface faster than traditional governance models can track.
The report found 87% of respondents rate non-human identity risk as moderately to extremely urgent, yet many organizations still face structural barriers to governance, including lack of visibility, excessive privileges, limited auditability, and long-lived credentials.
The data also signals a broader market shift. Forty-five percent of organizations already use IAM tools to govern non-human identities, and another 45% plan to implement them within the next year. Human-only identity governance is ending. Unified governance across human, non-human, and AI identities is becoming the baseline for modern security programs.
The full 2026 Future of Identity Report is available for download at the website here.
Related News:
The State of Non-Human Identity and AI Security Report Released
Qualys Expands ETM with Agentic AI for Identity Security and Threat Insights
