AI Agent Identity Lockdown
Ryan Smith@rms003
−8.4%
since Oct 7
The idea
I believe securing AI agents, software that logs into apps and touches sensitive data with real credentials, is the next big wave of cybersecurity spending, landing within the next year or two. The portfolio spreads across platform buyers who acquired agent-security startups, identity specialists best placed to capture this in reported sales, big-tech agent controls, the networks agent traffic runs through, and data access and recovery, so no single name carries the idea.
What it owns
- Large security platforms acquired agent-security startups and can sell that protection to their existing customer base. · CrowdStrike Holdings, Inc.It acquired SGNL to control what agents can access in real time and is building agent security with major cloud and chip partners., Palo Alto Networks, Inc.It acquired CyberArk, which secures privileged accounts and machine identities, and is positioning those controls for agent access., Cisco Systems, Inc.It acquired Astrix for tracking non-human accounts and already runs Duo for logins, so it can sell agent identity to its large customer base., SentinelOne, Inc.It acquired Prompt Security to monitor what AI tools and agents do while they run, adding runtime protection to its security platform., Check Point Software Technologies Ltd.It acquired Lakera to add guardrails that prevent agents from being manipulated into leaking data or misbehaving.31%
- These companies focus on identity and access control, so agent logins and permissions directly affect their sales. · SailPoint, Inc.It specializes in identity and access management, and sells directly into agent identity use cases, yet remains cheaper than peers., Okta, Inc.It is the dominant login platform and is pushing agent identity products as a direct way to control what agents sign into., Twilio Inc.It owns Stytch, which handles logins and permissions for applications and AI agents, offering a less obvious path to agent identity.22%
- These companies build and operate agents while also selling identity and access control tools for them. · Microsoft CorporationIt offers Entra Agent ID for agent identity and Defender for agent threats, bundling these controls into its dominant login platform., ServiceNow, Inc.It acquired Veza to map who and what can access which data, creating a foundation for managing agent access to sensitive information., International Business Machines CorporationIt owns HashiCorp Vault, where many companies store the passwords and keys that agents use to reach tools and data.18%
- Every agent request to an app or website passes through these networks, where connections can be inspected and blocked. · Cloudflare, Inc.It sits between agents and the apps they call, giving it a vantage point to decide which agents get through and charge for that access., Zscaler, Inc.It inspects every connection before allowing access to company apps, and agent traffic requires that same zero-trust verification., Akamai Technologies, Inc.It blocks malicious bots and protects APIs that agents use constantly, so it must distinguish good agent traffic from bad.16%
- When an agent's access causes problems, these companies track what data was touched and help restore what was changed. · Varonis Systems, Inc.It tracks which person or agent accessed which data, which is essential once agents start reading and moving sensitive files., Rubrik, Inc.It backs up and restores data and identity systems after attacks, handling the recovery phase when agents cause damage.6%
- Cash7%