AI agents are spreading through companies faster than security teams can map them. RSA is responding with RSA Agent ID, a new solution designed to give agents what employees have had for a long time: their own identity, clear permissions, and someone who is accountable for them.
Agents never sleep
Today, an AI agent is much more than a chatbot. It can open an application, query a database, or launch a process on its own, at any hour of the day or night. From a security perspective, it is just another “colleague” with access rights, except that it works far faster and is checked far less often than people are.
Jim Taylor of RSA puts it simply: when completing a task, an agent will try everything the system allows it to do. That is why safeguards built into the AI model itself are not enough. A company needs to be able to step in the moment an agent starts doing something it is not authorized to do.
Then there is shadow AI: agents that employees deploy themselves, without IT knowing. According to IBM, incidents like these cost companies an average of $670,000 more than standard incidents. It is no coincidence that Gartner named oversight of AI agents the top cybersecurity trend of 2026.
How RSA Agent ID works
Agent ID builds on the RSA Unified Identity Platform, which many companies already use to manage employee identities. As a result, agents don’t end up in a separate tool but in the same system as people. The solution has three parts, and companies can choose whether to deploy all of them at once or only the ones they need right now.
- Discover answers the question of which agents a company actually has. It scans the cloud, endpoints, and identity systems, and finds even the agents IT didn’t know about. Each one gets a registry entry with a named owner and a risk rating.
- Secure monitors what agents do. Every request an agent makes passes through a gateway (AI/MCP gateway), which checks it against company policy. For sensitive actions, the system requires approval from a specific person. And when an agent is decommissioned, its access disappears with it.
- Govern brings the kind of regular review companies already know from managing employees: who has access to what, whether they still need it, and who approved it.
Everything an agent does is logged. The records are mapped to 10 well-known security frameworks and can be sent to a SIEM, so during an audit the company has the evidence to show its agents are under control.
Just as important, companies don’t have to replace the identity provider they already use. The gateway can run in the RSA cloud, in a hybrid setup, or directly in the company’s own data center. Decisions about what an agent is allowed to do are made where the company wants them to be made, not by a third party.
Who it’s for and when it arrives
RSA has primarily in mind banks, insurers, government agencies, and operators of critical infrastructure. These are organizations where an agent that slips out of control is not just a technical problem but a risk to clients, finances, and reputation.
| Module | General availability |
|---|---|
| Agent ID Discover | November 16, 2026 |
| Agent ID Secure | November 16, 2026 |
| Agent ID Govern | First half of 2027 |
| Fully air-gapped, self-managed version | Planned for 2027 |
Final thoughts
AI agents will come to companies one way or another; the only question is whether security teams will have visibility over them. With Agent ID, RSA isn’t inventing new rules. It applies to agents what has worked for people for years: everyone has their own identity, their own permissions, and someone who vouches for them.
Want to see how Agent ID would work in your environment? Get in touch and we’ll be happy to show you.
Sources
- Security Boulevard: RSA Security Extends Identity Management Reach to AI Agents
- Business Wire: Hope Isn’t an AI Strategy – RSA Agent ID (press release)
- VMblog: RSA Agent ID benefits and use cases
- Pulse 2.0: RSA Launches Agent ID
- RSA: Press Releases
