SailPoint Navigate 2026 Launches Identity Controls for AI Agents

On 6 October 2026, SailPoint used its Navigate conference in Austin, Texas, to launch a broad set of products that treat AI agents as identities to be governed, much like employees. The release landed alongside a survey finding that 79% of organisations run AI agents in production, yet only 2% use identity security tools built for them.

That survey is SailPoint’s own, and the company is hardly a neutral party. It is a listed identity vendor with annual recurring revenue (ARR, the yearly value of its subscription contracts) above $1.2 billion.

SailPoint Navigate 2026 makes clear the company is staking its next growth leg on a category that barely has buyers yet.

Here is what was announced, how much of it shows up as real revenue today, and which dates decide whether the bet pays off.

Why SailPoint says AI agents are an identity problem the market has not priced in

The headline number is stark. SailPoint’s fifth annual Horizons of Identity Security report, which surveyed 340 senior identity, IT, security and risk leaders and graded them against a five-tier maturity model, found a gap of roughly 40 to 1 between agent adoption and purpose-built controls.

The 40-to-1 gap 79% of organisations run AI agents in production. Only 2% use identity security tools designed to govern them.

AI agents now make up 22% of all non-human accounts, according to the report. Agents are hard to govern because of how they get access in the first place:

• Many run on shared service accounts with little lifecycle management.
• Embedded API keys and long-lived secrets sit in configs, scripts and prompt chains, where they are hard to audit or revoke.
• Agents often inherit credentials from humans or applications, carrying standing privileges far beyond what the task needs.

The original source reporting on the survey also said UK organisations add as many as 10,000 AI agents and machine identities each month. That figure was not located in the report summaries reviewed for this article, so treat it as that outlet’s claim.

SailPoint frames the gap as structural rather than cyclical: agents are being embedded faster than controls can follow. The more telling figure may be the 85% of organisations still relying on legacy identity tools, which is the pool SailPoint actually wants to sell into.

Governance gaps around shared accounts and long-lived secrets are part of a wider AI agent security problem, in which authorised automation and malicious scripts look almost identical at the network level and binary blocking logic cannot separate them.

For you as an investor, the gap points to a large unserved market. But because SailPoint wrote the survey, it is better read as a sales thesis to test than as independent proof of demand.

What SailPoint actually announced, and which pieces are shipping when

The launch list was long. Sorted by readiness, it becomes much clearer.

Available or rolling out from Navigate are the platform’s core pieces. Agentic Fabric maps the agent footprint, finds “shadow AI” (agents deployed without IT’s knowledge), authorises actions as they happen and adds an agent kill switch. Human Fabric gains an embedded Harbor Pilot Access Request Agent, while Atlas, the underlying platform, adds workflow upgrades.

IdentityIQ 9.0 refreshes the on-premises product. Three classes of Autonomous Agents are designed to trim privileges and fix identity risks without halting automated workflows. Zero standing privilege replaces always-on access with just-in-time access, activated through Slack or ServiceNow.

The harder deliverables sit later. Autonomous Identity Security Posture Management (A-ISPM), which continuously scans for dormant accounts, orphaned access and hidden admins, is due in Q4 of fiscal 2027. So are the Harbor Pilot Policy Agent and a Proofpoint integration.

SailPoint also flagged a South Korea data centre and preparation for FedRAMP High, PCI DSS 4.0 and EU Sovereign Cloud standards. These are preparations, not certifications, and other sources reviewed did not corroborate them.

Entro: bought, available, not yet fully integrated

SailPoint completed its purchase of Tel Aviv-based Entro Security on 29 June 2026. Entro adds credential lineage, exposed secret discovery and monitoring of prompt intent. Terms were undisclosed, and third-party reports of a value around $200 million are unconfirmed.

Bunching A-ISPM, the Policy Agent, Proofpoint and Entro into one quarter means the roadmap’s credibility will be judged in a single reporting window. Any slippage would show up quickly.

Can the agent roadmap carry the numbers, and who else is competing for it?

The financial base is solid. In fiscal Q2 2027, which ended 31 July and was reported on 9 September, ARR reached $1.231 billion, up 25%. SaaS ARR (cloud subscriptions) rose 36% to $847 million, about 69% of the total.

Growth is easing, though. Revenue growth slowed to 17%, well behind ARR, and SailPoint posted a net loss of $50.4 million (GAAP diluted EPS of -$0.09, adjusted EPS of $0.09).

Growth is easing, and investors will weigh it against margins through the Rule of 40, the growth-plus-margin score that drives SaaS valuation premiums and discounts; a GAAP net loss alongside slowing revenue growth sits uneasily against that benchmark.

The only quantified agent metric is AI-driven ARR above $70 million, more than 30% of net new ARR. That tells you agent demand is already visible in bookings. At roughly 6% of total ARR, however, it is not yet what the share price rests on, so the next two quarters matter more than the survey.

Specialist platform or bundled feature?

Okta, Microsoft Entra and Saviynt tend to bundle machine-identity features into broader suites. CyberArk competes on privileged access management (PAM, tools that control high-level admin access), and CrowdStrike is both partner and rival. No competitor was found using SailPoint’s agent-identity framing, which leaves open whether buyers want a specialist or a feature inside a suite they already own.

Risks include execution timing, Entro integration, overlap with customers’ existing PAM and secrets tools, and buyer wariness about vendor lock-in. Watch three signals:

• AI-driven ARR’s share of net new ARR
• Delivery of Q4 FY27 features by 31 January 2027
• Whether larger rivals bundle comparable agent controls

What Q4 fiscal 2027 will settle, and what it will not

The Navigate launches are credible in scope but unproven in revenue. The strongest evidence for demand comes from SailPoint’s own survey, not from independent buyers.

Two tests now matter. The first is delivery: A-ISPM, the Policy Agent, Proofpoint and Entro all need to land by 31 January 2027. The second is commercial: the next earnings update will show whether AI-driven ARR keeps growing its share of new business. Shipping on time would confirm SailPoint can execute, but only the bookings will show whether customers are willing to pay.

Demand for agent controls will also depend on how security budgets are allocated, with Gartner projecting global information security spending of $244 billion in 2026 and most CIOs planning increases, though larger totals do not guarantee spending reaches identity tooling.

This article is for informational purposes only and should not be considered financial advice. Investors should conduct their own research and consult with financial professionals before making investment decisions. Past performance does not guarantee future results, and forward-looking statements are speculative and subject to change.