The Identity Security Control Plane for the AI Agent Era

RAG and enterprise knowledge bases will push data entitlement governance further to the front. According to research published by Cyera, 96% of enterprise permissions are in practice long unused, and AI agents will not, like humans, be "too lazy to open some resource"; once granted permissions, they may bulk-read, correlate, and export within milliseconds. BigID likewise merges DSPM, Data Access Governance, and AI SPM into a single integrated narrative, stressing that the core question is "what sensitive data exists, who can access it, and whether the access is excessive." So while data access governance is not a traditional core IAM budget, in the second phase after agents go live it may well become a large incremental pool for identity security.

Three Scenario Forecasts

The base scenario is the most reasonable assumption at present. The reason is not that every enterprise will quickly deploy fully autonomous agents, but that the moment enterprises use agents in places that "can operate real systems and real data," least privilege, delegation, human approval, tool authorization, secret rotation, and audit trail shift from "security recommendations" to "go-live prerequisites." That is why budgets will flow first to mature control points and then spread to the pure agent-identity layer.

Architecture Layers and Segment Value Breakdown

Typical Architecture of an Enterprise-Grade AI Agent Identity Security System

A deployable enterprise-grade AI agent identity security system typically comprises fifteen layers: agent discovery, NHI inventory, lifecycle, authentication, authorization/policy, least privilege, JIT/ZSP, secrets & certificates, API/MCP access control, RAG/data entitlements, ITDR, session/audit, human approval, compliance reporting, and SOC/SIEM integration. What is truly worth researching now is which of these layers are most likely to form a moat, and which will be swallowed by built-in offerings.

The strongest long-term moat is the entire bundle of NHI/agent inventory + authorization graph + least-privilege/JIT + secrets/cert lifecycle + audit trail, not any single feature point. Product roadmaps such as Microsoft Entra Agent ID, CyberArk AI Agent Gateway, Ping Identity for AI, SGNL, and Cloudflare MCP Portals are all converging in this direction: first give the agent an identity, then an owner, then a scope, then a revocable and auditable execution surface.

Deep Breakdown of Segments

The table below compresses the thirty segments you listed into the judgments that matter most from an investment perspective. Scores are 1–5, with 5 highest.

The single point most worth stressing is this: MCP Tool Access Governance and Agent Runtime Authorization are extremely important, but they are not yet the most certain revenue pools; instead, PAM, secrets, machine identity, and IGA extensions look more like the "real-world receiving layer" that catches this wave of budget. From an investment-timing standpoint, this means one should not fixate only on "the most cutting-edge new buzzwords," but should first find companies that can embed cutting-edge demand into mature budget line items.

Company Map and Investment Tiering

Master Table of Direct Beneficiaries, Platform Beneficiaries, Challengers, and Pseudo-Beneficiaries

Which Companies Have a Strong Narrative but Insufficient Financial Validation

There are currently three typical combinations of "strong narrative, insufficiently broken-out financials." The first is the large platform-security vendors: Cloudflare, Palo Alto Networks, Cisco, Trend Micro, and others have shipped MCP, agent lifecycle, AI security, identity-first, and similar features, but their public financials are still disclosed mainly at the larger platform level, making it hard to prove that AI/NHI identity subproducts have formed standalone ARR. The second is the high-buzz startups: Aembit, Oasis, Entro, Valence, Grip, Noma, and Lasso are in the right direction, but their public revenue/ARR disclosures are very limited. The third is regional integrated-security companies, especially Chinese vendors and some Japanese/Korean/Indian integrated-security firms or service providers; they may benefit at the margin from projects and defense demand, but public materials rarely break out NHI, agent identity, or MCP governance as verifiable revenue items.

The Private-Market Watchlist Most Worth Tracking

Key Listed-Company Research and Scoring

Listed Companies Most Worth Further Research

The table below compresses the listed companies most worth deeper digging into the few dimensions buyers care about most: segment position, revenue exposure, margin impact, valuation observation, and research conclusion.

Five Tiers and Investment Priority

Tier A: core direct beneficiaries of AI/NHI/agent identity security CyberArk, SailPoint, Microsoft, Okta, IBM/HashiCorp, JFrog. Their common trait is that the identity control plane is not an ad slogan but is already bound to chargeable, expandable, and auditable product layers such as PAM, IGA, Vault, developer security, directory, or cloud access.

Tier B: clear beneficiaries, but coexisting with valuation, competition, or platform-squeeze risk CrowdStrike, Cloudflare, Zscaler. All can benefit from the agent era, but they rely more on the "large security platform" absorbing value than on identity subproducts monetizing standalone; at the same time, their current market pricing is already fairly optimistic.

Tier C: more defensive tools, with weak near-term financial elasticity Palo Alto Networks, Cisco, Oracle, Trend Micro, Alibaba Cloud, Tencent Cloud. All need to round out their identity capabilities, or the platform will lose ground; but near term they look more like "defending platform competitiveness" than an independent, high-elasticity new profit pool.

Tier D: strong AI-identity-security narrative, but still insufficient evidence of actual benefit Most pure agent-security or broad AI-security startups, plus some regional integrated-security vendors. The issue is not the product direction, but that public revenue, ARR, retention, and customer penetration are not yet enough to support a secondary-market-style high-certainty judgment.

Tier E: single-point tool companies or segments with high platform-consolidation risk Single-cloud secrets, single-point certificate tools, point CIEM, point OAuth monitoring, secrets tools that only do static scanning, and traditional identity products that only do SSO/MFA. Both cloud providers and platform vendors are pushing down into these features.

Scoring Model and Results

This report uses the following total-score model to assign subjective scores on a 100-point scale to the key companies:

• Direct revenue exposure to AI/NHI/agent identity security: 25%

• Platform position and customer base: 20%

• Identity data and technical moat: 15%

• Product breadth and integration capability: 15%

• Financial quality and margins: 10%

• Growth elasticity: 10%

• Valuation reasonableness: 5%

A reverse risk model is also used to assess "risk of being consolidated by an identity platform":

• Risk of the core business being consolidated by a platform: 30%

• Single-point-tool nature: 20%

• Lack of data/platform/ecosystem moat: 20%

• Risk of budget being squeezed by cloud providers or large platforms: 15%

• Risk of overvaluation: 15%

The core of this scoring is not "who has the flashiest technology," but who is most likely to turn the NHI, tool authorization, runtime privilege, ownership, and data entitlements brought by AI agents into recurring ARR. By this standard, CyberArk, SailPoint, Microsoft, and Okta clearly rank ahead of most integrated-security platforms that "tell a good AI-security story but do not break out revenue."

Valuation, Risks, and Final Conclusions

Which Expectations Are Already Priced In, and Where Gaps Remain

Looking at market data as of May 19, 2026, the valuations of CrowdStrike, Cloudflare, Palo Alto Networks, and Zscaler already clearly include an AI-security and platformization premium. CrowdStrike's market cap is about $155.5 billion, a very high implied multiple to FY26 revenue of $4.81 billion; Cloudflare's market cap is about $71.1 billion, while its Q1 2026 single-quarter revenue is only $639.8 million; Palo Alto Networks trades at a P/E of about 136x, while Cloudflare, Zscaler, GitLab, and JFrog still sit in a negative-GAAP-P/E framework. In other words, these companies can indeed benefit, but their "benefit logic" and "valuation appeal" have already clearly diverged.

The relative expectations gaps lie with companies that have already formed a real identity-security revenue pillar but that the market has not yet fully re-rated as an "AI identity control plane." SailPoint is the most typical case: it has already written unified governance of AI agents, machines, and identities into its official narrative, with FY26 ARR reaching $1.125 billion; yet as of 2026-05-19 its market cap is only about $8.13 billion. IBM/HashiCorp is similar—Vault's infrastructure nature in secrets, PKI, and workload identity is very strong, but capital markets view it more through the lens of IBM as a whole, rather than pricing Vault separately as a control-plane asset under the agent explosion.

Representatives of "good company but valuation too expensive" are CrowdStrike, Cloudflare, Palo Alto Networks, and parts of Zscaler; representatives of "real revenue growth, valuation still researchable" are SailPoint, JFrog, and IBM/HashiCorp; representatives of "strong narrative but insufficient financial validation" include most AI-native agent/NHI startups and some newly launched AI-identity modules from large platforms.

Systemic Risks

The biggest fundamental risk is not that "identity security does not matter," but that enterprise agent adoption proceeds slower than the market imagines. If agents stay at the stage of Q&A, summarization, and code suggestions and do not truly plug into production systems, knowledge bases, ticketing flows, and automated approval chains, then the first to benefit will still be data security, foundation models, and cloud compute—not agent-identity-specific budgets. For pure agent-identity startups, this is especially critical.

The second risk is cloud providers pushing down. Microsoft, AWS, GCP, Oracle, Alibaba Cloud, and Tencent Cloud have already demonstrated enough built-in capability to compress the room for single-cloud secrets, basic workload identity, basic CIEM, and some certificate/credential management tools. Independent companies that lack cross-cloud, cross-SaaS, cross-data-layer unified ownership, policy, audit, and entitlement graph are easily marginalized.

The third risk is that standards are not yet stable. Although MCP security best practices and the authorization spec have taken shape, enterprises' governance approaches for MCP servers, tool-call authorization, cross-agent delegation, and approval semantics are still iterating fast. Betting too early on "one specific implementation" carries product-path risk.

The fourth risk is deployment complexity and business friction. The deeper identity security goes into runtime policy, ZSP, data entitlements, and human approval, the more it runs into business-process change, developer-productivity tradeoffs, audit workflows, and organizational responsibility boundaries. This lengthens sales cycles and raises customer-education costs.

Final Conclusions

Identity security and NHI's position in the AI value chain has already been upgraded from a "supporting security feature" to a prerequisite control layer for enterprise AI agents to truly land. Without independent identity, explainable permissions, short-lived credentials, tool authorization, and an auditable delegation chain, an agent can only stay at the demo stage; once an enterprise lets an agent truly touch production data and production systems, the identity control plane becomes a go-live prerequisite.

The five segments most worth watching are: PAM extending into NHI/agents, machine identity management, secrets/developer token security, IGA/NHI governance, and data access governance/RAG permissions. Together these five segments cover the six core questions of "who is executing, what can they do, where do the credentials come from, is there overprivilege, what data was accessed, and can it be held accountable."

The ten listed companies most worth deep research are: CyberArk, SailPoint, Microsoft, Okta, IBM, JFrog, CrowdStrike, Cloudflare, Zscaler, and Palo Alto Networks. Of these, the first six lean toward "control plane and revenue landing," while the last four lean toward "platform absorption and valuation elasticity."

The ten private companies most worth tracking are: Veza, Saviynt, Ping Identity, Delinea, BeyondTrust, Aembit, Oasis Security, Entro Security, Astrix Security, and Reco. Among them, the Veza/Astrix/SGNL path best embodies the M&A value of "unified authorization graph + runtime enforcement"; Aembit, Oasis, and Entro are more like the purest NHI-native objects to watch; Reco, Valence, and Grip represent another evolutionary path for SaaS/OAuth/Shadow AI identity risk.

The five points the market most easily misunderstands are: First, agent identity does not equal giving an agent an account; what truly matters is delegated authority, ownership, approval, and runtime authorization. Second, NHI is not a new species, but an identity surface that has always existed yet gone ungoverned. Third, MCP security is not a prompt problem, but an OAuth, resource server, scope, and tool authorization problem. Fourth, the first to make money will not be the "agent-security story," but PAM, secrets, machine identity, and IGA extensions. Fifth, identity security will become the control plane, but not with SSO dominating alone—rather as the union of identity graph, authorization graph, credential lifecycle, and data entitlements.

The metrics most worth tracking over the next 6–12 months are not a generic "AI revenue," but: CyberArk's machine-identity and AI-agent-related ARR and customer cases; SailPoint's SaaS ARR and NHI/AI governance penetration; Okta's AI Agents customer count and RPO/cRPO; the customer-adoption pace of Microsoft Entra Agent ID; CrowdStrike's integration of SGNL and FalconID penetration; the commercialization pace of Cloudflare's MCP/Zero Trust AI products; JFrog Security Core's share of revenue and RPO; and whether major identity-abuse incidents clearly involve agents, OAuth apps, tool abuse, or out-of-control delegation chains.

For narrower, deeper follow-on research directions, I suggest focusing on: NHI Security, Agent Runtime Authorization, PAM extending into agents/NHI, Secrets Management, Certificate Lifecycle, CIEM and Cloud Entitlements, RAG Permission Control, and MCP Tool Authorization. This is the intersection that currently comes closest to overlapping "real revenue landing" and "future control-plane moat."

This report is based on public information and does not constitute investment advice. Markets carry risk; invest with caution.