New research reveals autonomous AI agents are operating without supervision in 95% of APAC organisations that have deployed them.
New findings from the SailPoint Horizons of Identity Security Report reveal that a new class of semi-autonomous, highly capable but largely ungoverned non-human identities is now operating across Asia Pacific, making decisions, accessing data and holding credentials with no one watching.
The data points to a serious gap between ambition and control. While 85% of APAC enterprises now run AI agents in production, only 5% have deployed security tools purpose-built to govern what those agents can see and do. Across the region, 68% of organisations report still relying on manual or ad hoc processes to manage non-human and AI agent identities, even as regulatory expectations under frameworks like Australia’s Privacy Act reforms and APRA CPS 234 continue to tighten.
Nam Lam, Group Vice President, Australia and New Zealand at SailPoint, said:
“Business leaders are under pressure to drive growth through AI, but the data shows governance hasn’t kept pace. Most businesses in the region can’t say who owns a given agent, what it can access, or whether it’s still behaving as it should. That’s an urgent problem at this scale, because one agent operating outside its boundaries can do a lot of damage before anyone notices. ANZ enterprises need to treat agent ownership and oversight as a condition of deployment, not something to sort out afterwards. Organisations must discover every agent in their environment, automate its identity lifecycle and grant permissions only when required.”
Other key data:
62% of worldwide organisations that have invested in securing non-human identities report measurable productivity gains.
76% of global leaders expect stronger identity governance to improve their eligibility for — or the terms of — cyber insurance.
45% of organisations in APAC are still at the early stages of their identity security journey
Only 30% of APAC enterprises have mature capabilities for detecting shadow AI, meaning unsanctioned and ungoverned agent deployments
/Ends
About SailPoint
SailPoint (Nasdaq: SAIL) is defining the new era of adaptive identity security. In a world where non-human identities now significantly outnumber humans, our AI-powered platform unifies identity, security, and data intelligence to protect today’s enterprise from advanced identity-based threats. We deliver the identity solution that spans both the breadth of identities and the depth of context needed to drive real-time access with confidence. Built on principles like zero-standing privilege and contextualised risk, our SailPoint platform transforms identity from a point of vulnerability into a powerful security advantage. Trusted by many of the world's leading organisations, SailPoint secures the enterprise with intelligent, autonomous identity security.
As seen in:
ITBrief Australia https://itbrief.com.au/story/apac-firms-race-ahead-on-ai-agents-but-controls-lag