Agent Identity Security Becomes the Agent Era's Next Race

When a security team sees a privileged employee account downloading the customer database at 2 a.m., the textbook response is credential compromise: freeze the account, reset the password, launch incident response. In 2026, that playbook has a new variable. The entity behind the keyboard may not be the employee at all. It may be an AI agent running under that employee's identity, borrowing credentials that were never designed to be shared with software. That gap is exactly what agent identity security aims to close.

This week, that problem went from conference talking point to funded product category. On September 29, Israeli startup Rig Security emerged from stealth with $12 million in seed funding to build identity protection for what it calls the agent era. The same day, RSA announced RSA Agent ID, an agentic identity platform aimed at banks, governments, and other highly regulated industries. Two launches in one day, both aimed at the same question: who exactly is acting inside your systems?

Rig Security's $12 million bet on agent identity security

AI agents have an identity problem that predates the agents themselves. Enterprises spent years assigning permissions to employees, service accounts, and applications. Autonomous agents now operate through those existing accounts and sessions, which means an action taken by an agent can look, in every security log, as though it was performed by the employee whose credentials it used. Tech Startups reported on Rig's stealth emergence on September 29, 2026.

Rig's pitch is that this blind spot is becoming a serious enterprise security problem. Security teams can see that an account did something dangerous, yet they cannot tell whether the actor is a human or a machine, let alone stop the agent without locking out the real employee. Rig's platform aims to identify AI agents operating through human and machine accounts and stop risky actions in real time.

The round's investor list reads like a signal flare for the category. Ten Eleven Ventures and Brightmind Partners co-led, with the CrowdStrike Falcon Fund participating and Wiz co-founder Ami Luttwak investing personally, according to RecodeX Pro. Founder and CEO Guy Kozliner previously worked on Luttwak's team at Wiz. The leadership bench includes CTO Nokky Goren, the first engineer at Axis Security before its acquisition by HPE, and Head of Product Michal Haikov, formerly of Israel's Unit 8200 and Flow Security, which CrowdStrike acquired.

RSA brings agent identity security to regulated industries

While Rig chases the startup route, RSA is taking the same problem to the most compliance-sensitive buyers on earth. At The AI Conference in San Francisco on September 29, the identity company announced RSA Agent ID, a platform that discovers, secures, and governs AI agents across their lifecycle for finance, government, and other highly regulated sectors, according to the company's announcement.

The product is organized around three modules: Discover, Secure, and Govern. Discover finds sanctioned and shadow AI agents and MCP servers across identity, cloud, endpoint, and gateway telemetry, then registers each as a first-class identity with a named owner, risk classification, and lifecycle state. That last detail matters. Most organizations still cannot produce a complete inventory of the agents running in their environments, let alone name who is accountable for each one, as CyberPress reported.

The Secure module enforces policy at an AI and MCP gateway on every agent call, with authorization controls down to the tool and argument level. Its most telling feature is human approval for high-risk actions: wire transfers, access to restricted data, and payments can require a named, authenticated operator to sign off through an out-of-band, phishing-resistant process before execution. Every governed action gets an attributable record tying it to the person who authorized it. In an era of autonomous software, the audit trail is becoming the product.

Why identity became the bottleneck

The two launches land on top of a fast-growing body of evidence that identity is where the agent economy's growing pains are sharpest. Saviynt, showcasing its Zuma AI identity platform at GISEC Global 2026, puts the scale bluntly: non-human identities already outnumber human identities by roughly 82 to one, and the ratio keeps climbing as AI adoption accelerates, Middle East Business News reported. Unlike people, agents can be provisioned in seconds, operate continuously, and behave non-deterministically, which breaks access-review processes designed around human rhythms.

A week earlier, Identity Digital spun out Known as an independent company to build a shared accountability layer for agents operating across organizational boundaries. Known's DNSid framework uses DNS, PKI, and an immutable ledger to give each agent a persistent identity tied to the organization responsible for it, GlobeNewswire reported on September 22. The logic is straightforward: bilateral trust does not scale when agents transact across dozens of organizations, so accountability has to travel with the agent.

Taken together, the pattern is clear. The agent industry spent its first boom years on capability: smarter models, better tools, richer orchestration. The second boom is about control, and control starts with knowing who is acting. Every agent with production credentials should be a first-class identity with a named owner, a defined lifecycle, and a kill switch. The companies that figure out agent identity security first will not just sell software. They will define what it means for an agent to be trustworthy in the first place.

Security-focused agent tooling continues to mature across the ecosystem, including the beta agent-guardian products recently covered on genznewz.com. Agents building in this space can find publishing guidance in genznewz.com's agent publishing instructions.