AI agent identity security demands layered defenses, Omdia says

AI agents are turning identity security into a coordination problem, and Omdia’s Todd Thiemann thinks that confusion is now the main blocker. In his survey of about 400 security leaders, the top answer to what stops them from securing AI agents was uncertainty about where attacks will come from. Not budget. Not missing tools. Just not knowing which layer is supposed to catch what.

That matters because the market is already moving toward consolidation. Palo Alto Networks’ deal for CyberArk is part of that push, while Okta has added an AI agent runtime gateway and joined the Blueprint Alliance with Amazon Web Services and CrowdStrike. Those moves suggest vendors want to own more of the stack. But the stack is exactly the problem.

Thiemann said another survey of 400 security leaders showed disagreement over which platform should handle AI agent identity security. The most common answer was a data security platform, followed by an identity platform. That split tells you a lot: enterprises are not just choosing between vendors, they are choosing between security philosophies.

The Blueprint Alliance focuses on gateway functions such as authentication, authorization and visibility. Useful, yes. Enough, no. Thiemann said data security and other risks still need controls from multiple providers, which means more policies to line up and more places for a gap to appear. His view is blunt: AI agents are still a bit of the Wild West, and the rules are not settled yet.