The Truth About Rogue Agents — with SailPoint CEO Mark McClain

That's the danger of agents, right? An agent can take thousands of actions in a second because it's a program, right? Humans can't hit the keyboard a thousand times in a second. So no matter what, if a human's gone rogue, there's only so much damage they can do in a limited amount of time, theoretically at some level. Here you've got, with automation and machine speed, a completely different calculus on how rapidly bad things can unfold.

Good to see you, Kyle.

What seems to be rapidly getting clearer is, whatever else is true, these agents — because they have autonomy at some level and are non-deterministic — they are more like people than not in certain respects in how they operate. And that's why we in the identity security landscape are saying you need to think of them like new identities, new kinds of identities that have the ability to not just do things but even make decisions on how they do things. And that's both promising, right, in terms of what it can do for business, and pretty threatening for security people in terms of what are these things and how many of them are there and where they come from and who authorized them. And as we've all seen with some of the news, Kyle, what can they do? Maybe more than I thought they could do. So, yeah, just lots of moving parts on the landscape. If nothing else, everyone is talking about it because they're wrestling with what to do about it.

You know, Kyle, that is something that we at SailPoint are particularly focused on. I'm glad you mentioned that. You know, I think there's kind of a set of new startups and energy in the industry around you've got to manage agents. And we're not the lone voice, but one of the fewer voices saying, look, to be fair, the bulk of these agents, not just for the foreseeable future but particularly right now, are operating very much in the context of a human, right? It's co-pilot type things. It's the agent doing something on Kyle's behalf — Kyle's agent doing something on Kyle's behalf, right? Well, that says then if you're going to manage this agent and its access and the data it's supposed to get to or act on, don't you have to do that in the context of Kyle? And if you don't have a good handle on what Kyle is supposed to access and how well that's controlled and understood, you're going to have issues with Kyle's agents. It just stands to reason, right?

So in our minds, Kyle, you're absolutely right. If I'm the security person in an enterprise, as I think about this agentic problem, it almost forces me to think about, well, how well am I managing my people today? Because if I'm not managing my people well — and people, as we know, Kyle, includes employees and contractors and partners, not just our employees, right? Lots of people accessing our systems in typical companies. It's those people and the agents acting on their behalf that I better get a handle on. And that's, I think, a rapidly emerging thought for folks in the industry.

It's not whether there are some multiple of humans, it's how many multiples of humans. And there's been, as you know, Kyle, from folks like Jensen Huang at Nvidia and others, wild estimates. I think at one point Jensen was saying a thousand to one. I think he's brought it down to 100 to one, but it's certainly not one to one or two to one or three to one. I don't think anybody thinks we're going to land on that low of a number in terms of numbers of agents on average per human. There are just too many things that we're all seeing that agents can do. So it's going to be some significant multiple. I think we're in the camp that thinks it could easily get to double digits, meaning ten to one would not be a far-fetched thought. And so when we think about that, just the sheer volume and complexity that adds to most people's mandate, right? I mean, just if you said to any security professional, Kyle, hey, guess what? We're going to have five times as many people next year as this year. They'd go, what? Like, I am not ready for that. I don't know what to do with that, right? We might add 10% more, even a fast-growth company, 30% more. But you say 5x or 10x to people, whatever plans they had no longer hold, right?

Like, things have just changed dramatically when you get into that mindset. I like to say, if you're a baseball guy, we're not even in the bottom of the first yet in AI. I think it's still the top of the first. We're super early in this evolution and people are wrestling with, I'm going to have a lot of these things. They're kind of autonomous or at least take a lot of independent action. No one's quite clear how many we have. The whole shadow AI thing is a new term, just like we had shadow SaaS for a while. How many of these are there? Where'd they come from? Who authorized them? These are really challenging problems to get our arms around.

I think a lot of organizations are in this mode of early on, in these early stages of the game. More work is going to be done around kind of enhancements. Even the old term, augmented intelligence — some people unpack AI as augmented instead of artificial, meaning it's going to be augmenting the work of people. An awful lot of what I think we're seeing early on is that, right? I'm still doing my job. The AI and the agents at my disposal are helping me do my job faster, better, more efficiently, more effectively. Not a lot yet done in production for sure today. I think we're headed toward more true rethinking of whole systems and workflows, business processes leveraging AI. Lots and lots of companies are working on that. I don't think I'm speaking out of turn to say not a lot of that is in production today in mid to large organizations, but that wave is coming. But the short term is more the extension of the people just doing their jobs as a product person, an engineer, or whatever. A lot of companies are talking about fairly dramatic improvements in how they build software, the rate they build it, the quality they can get out, you know, functionality. So we're seeing early signs of opportunity, Kyle, for sure.

So I think every company should be wrestling with, in these kind of augmented agents, like I'm helping my people, no matter what their function so to speak, do their job a little better — think about those issues now, because that's probably what's largely showing up. And then, yes, the bigger, larger, complex Fortune 2000 organizations are very much, I think, investing in reworked business processes. The other point I'd make is, and the vendors, right, like ServiceNow and Salesforce and all the application vendors in the world that build these business apps for the companies they serve, they're clearly investing in how does AI change or enhance those business processes. But I think that's where customers are a little more cautious at the rate of adoption there.

They don't know right from wrong. They are just software, and they're given a task and they're going to go try to accomplish the task. And what we've learned is they may take some paths or actions that a human would think was inappropriate, because we have ethics and morality, hopefully, in our work, but they don't know that they did anything wrong. They're just trying to solve the problem, accomplish the mission. And so what we're seeing is, oh my, you know, these technologies weren't necessarily built with those kinds of guardrails. And so to their credit, I think the big LLM vendors, you know, all the names we know out there getting ready to IPO and such, they're rapidly trying to put some kind of guardrails and policies in place. AI and LLMs were designed to grab lots of information, throw it into these models, and then help you learn things and solve problems. They weren't trying to control and limit, which is a security mindset. They were wide open. Let's get all this data. And so I think we're seeing now, like, oh, it's going to be challenging.

So I think the good news for SailPoint, the good news for the kind of resellers and channel folks you guys talk to in your publication so much is, look, there's massive opportunity to walk into customers and say, I'm here to help. Because I think they're looking for help. They're concerned about what they're hearing and seeing and reading. They feel this pressure from their organization, from their competitors, to move quickly and adopt these things for business value. Discovery is kind of job one, as we've said in security forever. You can't manage what you can't see, right? You have to know you have something to manage and secure it. But boy, there's a lot of noise in discovery, Kyle, today. I think the challenge is, well, once you can see these things, is that just telling me on my dashboard that bad things are happening? I just see them, but I can't do anything about it. So the trick is moving beyond the visibility to the ability to constrain or control or secure with policy.

That's an important part of what our products are certainly capable of helping companies with, and very importantly, getting better and better at anticipating and seeing problems developing and stopping them before something really bad happens. I think that's probably where we're headed next, is trying to stop bad things from happening as much as we can. And given that we can never stop all those things, can we detect when something bad is starting to happen? And since these things operate at machine speed, how fast can we go shut that down, you know, with various tools at our disposal? The infamous kill switch is a term out there today. When an agent starts to go rogue — our Hugging Face example that was all over the news — how fast can you go stop that thing, right? It's gone over the edge, something bad is happening, put a stop to it right now. That's, I think, where we're headed quickly with our technology and collaboration with others in the security landscape: to identify agents, try to constrain them with policy according to the people they're tied to — that human-agent connection, as we said. And then lastly, but we won't be perfect at that: how do we make sure we detect when something bad has started to happen and shut it down as quickly as possible?

There's going to be times when something is so clearly happening wrong. We want an automated response that stops something bad or dangerous from happening. And to your point, that's what's kind of new and different because we're not used to the fact that bad things can happen at such high speed. That's the danger of agents, right? An agent can take thousands of actions in a second because it's a program, right? Humans can't hit the keyboard a thousand times in a second. So no matter what, if a human's gone rogue, there's only so much damage they can do in a limited amount of time, theoretically, at some level. Here you've got, with automation and machine speed, a completely different calculus on how rapidly bad things can unfold, right? And I think that's, like you said, it's going to cause us to think differently about things like automated responses. You know, we call it response and remediation. How fast can you respond? How fast can you remediate whatever led to this problem so it can't happen again? Those kind of things, Kyle, I think are very, very real things that are unfolding in this realm of agentic security.