Security Report · raw.githubusercontent.com

Okta 2026 Report Finds AI Agent Adoption Outpacing Identity Governance

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Okta’s Businesses at Work 2026 report finds that 91% of surveyed organizations use AI agents, but only 32% govern them as rigorously as human identities. Platform data also shows rising adoption of high-assurance authentication and automated governance.

Key points

The report analyzes Okta platform activity from November 2024 through October 2025, supplemented by a survey of 261 C-suite and VP-level respondents; its platform findings reflect Okta customer environments.
Among surveyed organizations, 91% reported using AI agents, but only 32% governed them with the same rigor as human identities. Governance and oversight was the leading agent-security concern, cited by 58%.
Although 74% of surveyed organizations reported moderate or widespread non-human identity use, 90% lacked a comprehensive governance strategy; access and permissions were the leading concern.
High-assurance authentication adoption reached 58%, up from 50% in 2024. Okta FastPass authentication volume increased 81% year over year.
Okta ThreatInsight telemetry showed a detected-threat-to-authentication ratio of 78% for nonprofits, compared with 18% a year earlier; wholesale trade reached 44%, up from 11%.
Average access requests per company increased 158% year over year, while access certifications rose 76%. Centrally managed service accounts grew 650%, though the report notes that centralized telemetry captures only part of the service-account footprint.
The report recommends phishing-resistant authentication, continuous least-privilege governance, service-account rotation and vaulting, and consistent identity controls across cloud and on-premises systems.

Article Details

Publisher: Okta
Report Period: 2024-11-01 to 2025-10-31
Scope: Workforce identity security, application adoption, AI-agent readiness, and non-human identity governance across Okta customer environments worldwide.
Sample Size: Platform activity across thousands of organizations; supplementary AI at Work 2025 survey of 261 C-suite and VP-level respondents. Exact platform organization count not disclosed.
Key Statistics: Among surveyed organizations, 91% reported using AI agents, but only 32% governed agents with the same rigor as human identities.
Among surveyed organizations, 74% reported moderate or widespread use of non-human identities, while 90% lacked a comprehensive strategy to govern them.
High-assurance authentication factors were used by 58% of companies, compared with 50% in the preceding year and 41% two years earlier.
The nonprofit detected-threat-to-authentication ratio reached 78%, compared with 18% in the preceding year; these ThreatInsight ratios are telemetry proxies, not confirmed breach rates.
Average access requests per company increased 158% year over year and 1140% over two years. The report notes that access-request growth reflects the 2023 OIG platform expansion, customer-base growth, and workflow integration.
Recommendations: Replace low-assurance authentication factors with phishing-resistant methods, including passkeys and hardware-backed authenticators, and apply risk-based authentication.
Maintain continuous visibility and real-time auditing of AI agents, covering discovery, identity assignment, authorization, and access to credentials and secrets.
Automate provisioning, access changes, and deprovisioning, enforcing least privilege throughout human and non-human identity lifecycles.
Extend consistent authentication and identity policies across cloud, legacy, and on-prem environments through a unified identity control plane.
Centralize service-account visibility and governance, including lifecycle controls, credential rotation, vaulting, and consistent policy enforcement.