Who Controls the AI Agents
Ryan Nguyen@nguyen
−9.6%
since Oct 10
The idea
I believe the explosion of AI agents inside companies, each touching email, finance systems, customer data and cloud infrastructure, forces security spending up rather than down, especially as attackers use the same AI to phish and impersonate at scale. To express this I built a basket across four layers: platforms that acquired identity startups, network checkpoints agent traffic runs through, the remaining independent identity companies, and attack-detection specialists.
What it owns
- Large security and software companies that acquired identity startups this year can now sell agent access controls to their existing customer bases. · Palo Alto Networks, Inc.Acquired the leader in locking down powerful accounts, putting privileged agent access inside the largest security platform for existing customers to buy., CrowdStrike Holdings, Inc.Acquired identity controls that determine what agents can reach while running, layered on top of its attack detection platform., Microsoft CorporationIts login system handles most large companies' employee access and its platforms also host many agent builds, sitting at both ends of the control problem., Cisco Systems, Inc.Owns login verification tools and acquired technology to find and govern the API keys and service accounts that agents use to connect., ServiceNow, Inc.Acquired technology that maps who and what can touch which data, and runs the workflows where many company agents will live and operate., Twilio Inc.Provides verification and login tools that developers use to confirm who or what is on the other end of a message or call as AI impersonation grows.40%
- Agent traffic to apps and data passes through these gateways, where permissions get checked and enforced before connections complete. · Zscaler, Inc.Sits between users, apps and the internet to check every connection, so agent traffic to email, cloud and data must pass through its filters., Cloudflare, Inc.Handles a huge share of internet traffic, putting it in position to see and filter calls between agents, APIs and websites in real time., Fortinet, Inc.Sells cloud-delivered network security where much of agent traffic gets inspected and blocked, with subscriptions growing as automated threats increase.24%
- Independent companies whose core business is deciding who and what gets access are now selling that capability to firms running AI agents. · Okta, Inc.The largest independent identity company answers the question of what each AI agent is allowed to do for thousands of agents across enterprises., SailPoint, Inc.Decides who and what gets access to which systems and reviews permissions over time, solving the exact access control problem thousands of agents create.14%
- AI makes phishing and automated attacks cheaper, so companies that spot breaches, risky data access and weak spots gain more work. · SentinelOne, Inc.Stops attacks on laptops, servers and cloud workloads while leaning into protecting AI systems as they run against automated threats., Varonis Systems, Inc.Watches who touches sensitive company data and flags strange access patterns, exactly the risk when agents read customer data and internal documents., Tenable Holdings, Inc.Finds weak spots in systems before attackers do, and AI lets attackers find those same weak spots faster without human involvement.14%
- Cash8%