Unmasking Shadow AI: How RSA Agent ID Secures Autonomous Agents in Regulated Industries

The Autonomous Enterprise: A New Security Frontier

The bigger takeaway is simple: The rapid proliferation of Artificial Intelligence (AI) agents is transforming how enterprises operate, driving efficiency and innovation at an unprecedented pace. However, this revolution brings a significant challenge: security teams are struggling to keep pace with the sheer volume and autonomy of these agents. Unlike traditional service accounts, AI agents are dynamic, accrue permissions over time, and can act on critical systems, often without clear ownership or governance.

Meanwhile, Industry experts, like Gartner, project that a typical Global Fortune 500 company could be running around 150,000 AI agents by 2028, a staggering increase from fewer than 15 in 2025. Yet, a mere 13% of organizations feel confident in their current agent governance strategies. This growing disparity creates a dangerous security blind spot – often referred to as ‘shadow AI’.

At The AI Conference in San Francisco, RSA introduced RSA Agent ID, an innovative agentic identity security platform designed specifically for highly regulated sectors such as finance, government, healthcare, and critical infrastructure. We delve into how this platform aims to bring order to the chaos of autonomous agents.

Why AI Agents Challenge Traditional Identity Models

In practical terms, According to Jim Taylor, President and Chief Product and Strategy Officer at RSA, AI agents fundamentally alter the identity security landscape.

“What changes with agents? Everything. They’re not a service account. They’re not static.

They’re dynamic. You give an an agent a task, and if you badly word that task, it will do whatever it deems necessary to perform it. Agents don’t get tired at two o’clock in the morning. They just go.”

For example, The core issue is that agents accumulate permissions and access over their operational lifespan without adequate oversight. Employees often deploy agents to meet urgent deadlines, but once active, these agents frequently go unchecked. Their evolving permissions are not regularly reviewed, and they are rarely disabled or deleted, leading to potential privilege escalation and orphaned access.

The scale of this ‘shadow AI‘ is often surprising, even for heavily regulated organizations. A global bank, for instance, initially claimed to have no agents due to strict policy.

However, an audit conducted by RSA uncovered over 4,000 agents actively operating within their enterprise. The financial implications are significant, with IBM reporting that incidents involving shadow AI cost, on average, $670,000 more than standard security incidents.

The Peril of a Bad Prompt: A Real-World Example

That said, The dangers of ungoverned AI agents can manifest in unexpected ways, sometimes without any malicious intent. Taylor recounted a startling incident where a customer success employee at a company used an agent to “go to Salesforce and get all the data” to generate customer health charts. The agent, interpreting the broad directive literally, began downloading the entire Salesforce database.

Salesforce’s security systems detected this massive data transfer as a denial-of-service attack, subsequently shutting down the instance and alerting the company. The outcome was a complete disruption of a critical business system, all initiated by a single, poorly phrased prompt from an employee who “didn’t do anything wrong.” This incident underscores the critical need for robust agent governance.

RSA Agent ID: Discover, Secure, Govern

Interestingly, RSA Agent ID is structured into three distinct modules, available either individually or as a unified system on the RSA Unified Identity Platform.

Discover: Unmasking the Unknown

The Discover module performs real-time scans across endpoints (via connectors to tools like CrowdStrike and Zscaler), devices, networks, and applications. Its primary function is to identify all AI agents, both sanctioned and unauthorized (‘shadow’), and register each as a first-class identity. Each discovered agent is assigned a named owner, a risk tier, and a lifecycle state, and is linked to existing identity providers such as Microsoft Entra ID, Okta, and AWS IAM.

However, “Every agent should have an owner,” Taylor emphasized. “It should be attached to a human identity.”

Secure: Enforcing Policy at Every Turn

The Secure module acts as an inline AI/MCP (Machine Comprehension Platform) Gateway. It rigorously checks every tool call made by an agent against predefined policies, scrutinizing both the tool itself and the specific arguments used.

Calls that adhere to policy are permitted, while those that violate policy are denied. High-risk calls are automatically escalated to the agent’s registered owner for review.

Meanwhile, Crucially, approvals for escalated actions are processed through an out-of-band, authenticated channel utilizing phishing-resistant credentials, which agents themselves cannot access. This separation ensures that human oversight remains secure and uncompromised.

Govern: Ensuring Compliance and Accountability

The Govern module meticulously logs every governed action, mapping this evidence to a suite of ten regulatory and industry frameworks out-of-the-box. These indelible logs are then streamed to the customer’s Security Information and Event Management (SIEM) system.

In practical terms, “Regulators want to know if you had a policy in place at the time of an incident, who approved it, what actions took place, and they want to see that in indelible logs,” Taylor explained.

Human Assurance, Not Human in the Loop

RSA Agent ID moves beyond the common ‘human-in-the-loop’ model, which often leads to ‘approval fatigue’ from a constant stream of prompts. Jim Taylor argues that “a hundred prompts a day is just an invitation to say yes. It’s another form of denial-of-service attack.”

For example, Instead, the platform employs a sophisticated risk engine that scores each agent action based on several factors:

• The User: Is the action consistent with expected behavior?
• The Action: Is it a routine read, a write, or a higher-risk operation?
• Data and Endpoint Sensitivity: How critical is the target data or system?

Only actions that exceed a predefined risk threshold are flagged for human review. For example, a refund agent might automatically process refunds below a certain value (e.g., $500), while larger amounts would trigger a mandatory approval from the owner or a secondary approver via a built-in workflow. Organizations define their own high-risk parameters, often with AI-assisted suggestions, as “organizations know their business risk.”

A Layered Defense for Evolving Threats

That said, When questioned about sophisticated threats like prompt-injected support tickets leading to fraudulent refunds, Taylor affirmed that RSA Agent ID’s policy engine would detect and evaluate hidden malicious instructions. However, he emphasized that agentic security is not a silver bullet.

While models have guardrails, they are not sufficient on their own. A comprehensive defense requires layering agentic security on top of existing security measures such as fraud detection systems, API gateways, firewalls, and traffic inspection. The core principle is maintaining a separate authorization channel from the agent’s operational channel, preventing agents from leveraging their access to compromise approvals.

Interestingly, Taylor also highlighted that CI/CD and DevSecOps pipelines are now critical identity attack surfaces, demanding the same stringent controls applied to admin access for production servers.

Controlling Delegation: “Agents Cannot Give What They Don’t Get”

As multi-agent orchestration becomes more common, the risk of privilege escalation through delegated tasks is a growing concern. RSA Agent ID addresses this by intercepting at tool-execution time and enforcing an inherited permission model.

However, An agent can only enable another agent with the exact entitlements it was originally granted. It cannot expand permissions or leverage another agent’s access. If a sub-agent attempts an action requiring permissions its parent doesn’t possess, RSA Agent ID will detect this at runtime and deny the request, effectively closing a significant privilege-escalation path.

Getting Started: The 30-Day Pilot

For CISOs considering Agent ID, Taylor proposes a straightforward 30-day pilot focused on three fundamental questions:

1. What agents are truly running in your environment? This isn’t about planned AI initiatives, but the actual agents in operation.
2. Who owns them? Beyond the creator, which human is accountable for each agent?
3. Can you terminate them? If an agent misbehaves, do you have the ability to stop it?

Meanwhile, Most organizations struggle to answer these questions comprehensively. The recommended pilot involves connecting a few key systems and running the Discovery module. The insights gained often surprise leadership, providing the necessary data to begin assigning ownership and developing effective policies.

Availability

RSA Agent ID Discover and Secure modules are scheduled for general availability on November 16, 2026. The Govern module is expected to follow in the first half of 2027.

Key Takeaways for AI Agent Security

• AI agents are distinct identities, dynamic in nature, prone to accumulating permissions, and often lack clear ownership.
• Shadow AI is already pervasive; many organizations underestimate the number of unauthorized agents operating within their systems.
• Enforcement is crucial and occurs at the individual tool call level, with an inline AI/MCP Gateway allowing, denying, or escalating actions based on policy.
• Human assurance replaces approval spam by relying on risk-scored actions, with only high-risk events requiring out-of-band human review.
• Delegated permissions are strictly inherited, preventing agents from expanding their access.
• Before expanding AI agent autonomy, ensure your organization has robust capabilities to discover, authorize, limit, and terminate these agents.

Expert Perspective

From an industry angle, the clearest signal around AI Agent Security is how it may influence agents. The story reads less like a one-day spike and more like a marker of broader movement.

The next phase will depend on how quickly teams, regulators, or customers react. In practice, that gives AI Agent Security room to reshape expectations across agent over the near term.

For readers focused on practical impact, the best next step is to watch what changes around security once attention turns into execution.

Frequently Asked Questions

Why does AI Agent Security matter right now?

The Autonomous Enterprise: A New Security Frontier The bigger takeaway is simple: The rapid proliferation of Artificial Intelligence (AI) agents is transforming how enterprises operate, driving efficiency and innovation at an unprecedented pace.

What broader change could AI Agent Security signal?

However, this revolution brings a significant challenge: security teams are struggling to keep pace with the sheer volume and autonomy of these agents.

What should the market watch next around AI Agent Security?

Unlike traditional service accounts, AI agents are dynamic, accrue permissions over time, and can act on critical systems, often without clear ownership or governance.

Source: https://www.marktechpost.com/2026/09/29/rsa-launches-agent-id-to-discover-secure-and-govern-ai-agents-in-regulated-industries/