Oak Research Finds More Than Half of Security Leaders Can't Fully See Who, or What, Has Access to Their Systems

Oak Research Finds More Than Half of Security Leaders Can't Fully See Who, or What, Has Access to Their Systems

Visibility gaps, unreachable applications and ungoverned non-human identities persist despite heavy identity investment as AI agents raise the stakes

TEL AVIV, Israel and SAN FRANCISCO, Oct. 20, 2026 /PRNewswire/ -- Oak, the AI-native Identity Operating System governing every human, machine, and AI agent identity, today released The Voice of 200 CISOs, an original report based on 201 in-depth interviews with CISOs, IAM leaders and security practitioners. Conducted between January and September 2026, Oak researchers found that organizations have invested more in identity than ever yet still struggle to build a complete picture of every human, machine and AI agent identity in their environments and what they can access.

Investment in the identity landscape has continued to soar, with identity and access management spending forecasted to increase from $18.7 billion in 2024 to $29 billion in 2029. Gartner predicts that by 2028, the average global Fortune 500 enterprise will have more than 150,000 AI agents in use, up from fewer than 15 in 2025, while only 13% of organizations think they have the right AI agent governance in place. The research found that many identity programs are already struggling to manage the surge in non-human identities. Incomplete visibility into identities and access was the most common problem, raised in 51% of security leaders.

"Identity security has long been the hardest problem in enterprise security, and these conversations explain why," said Shai Morag, CEO and Co-Founder of Oak. "What surprised us is that company size didn't predict who had it under control. Companies with mature identity programs and teams with a single person on identity were stuck in the same place. The legacy identity model wasn't built to work as one system, and the proliferation of AI agents amid increasingly complex infrastructure is now exposing its flaws faster than security teams can manage alone."

Key research findings from respondents include:

• Visibility is a key problem: 51% said incomplete visibility of organizational identities is a problem, and 38% flagged applications their identity program doesn't reach. Participants described single employees holding several disconnected accounts and application roles that cannot be explained.
• Machine and agent identities deepen the blind spot: 37% mentioned governance gaps around non-human identities such as service accounts, credentials, workloads and agents. Of those, 67% also raised visibility problems, 48% raised appropriate-access problems and 36% raised lifecycle problems. Service accounts and API keys are often created with no owner or end date. One practitioner found about 12,000 service accounts "before we had a single AI agent."
• Identity tools create their own workload: 34% pointed to recurring manual work as an issue in identity programs and 29% mentioned the cost of operating and changing identity tools.
• Fixing risky access depends on other teams and systems: 26% of participants reported an access-review burden and 23% mentioned lifecycle gaps, highlighting a consistent gap between identifying inappropriate access and removing it, since remediation usually requires a change in another system made by another team.
• Excess access remains because removing it feels riskier: 32% of interviews had difficulty defining and maintaining appropriate access, and 20% raised concerns about trusting automated access changes.

The report outlines two ways forward. Security teams can take on one high-value gap their current governance tools leave open, measure the result in access removed and hours saved, then expand from there. Where each expansion means another rebuild or custom integration, the findings point to a broader shift to an operating model that governs people, machines and agents as one connected system. Several of the security leaders interviewed already plan to unify access reviews, rethink their governance platforms and bring agents into scope next year.

The full report is available here.

About Oak

Oak is the AI-native Identity Operating System that rewires enterprise identity and access management. With an AI connector framework that reaches any application, whether on-prem, cloud, SaaS, or homegrown, it builds a live identity graph from raw evidence across every identity type, including the fast-growing population of non-human identities and AI agents. By mapping the access each identity holds against what it actually uses, Oak governs the full lifecycle of every identity with AI-built real-time risk decisions and root-cause remediation. Oak was founded by Shai Morag and Tal Marom and backed by a $60 million seed round from Greylock, Accel, CRV, and Hetz Ventures. Learn more at oak.id.

Media Contact
Kate Schoenstadt
[e-mail]
[phone]

View original content:https://www.prnewswire.co.uk/news-releases/oak-research-finds-more-than-half-of-security-leaders-cant-fully-see-who-or-what-has-access-to-their-systems-302914250.html