RSA Agent ID Review: AI Agent Discovery, Security, and Governance

RSA Agent ID review shows the platform launched by RSA to treat AI agents as first-class identities in environments with strict regulatory requirements. Announced on September 29, 2026, at The AI Conference in San Francisco, the tool extends RSA's existing identity and governance capabilities to handle agent sprawl. Organizations in finance, government, healthcare, and critical infrastructure gain inventory tools, policy enforcement points, and audit mapping that traditional service accounts cannot deliver.

RSA Agent ID Overview and Market Context

The platform addresses the rapid growth of AI agents that often operate without assigned human owners or stop mechanisms. RSA documentation cites cases where a single prompt led to a Salesforce outage and a bank audit uncovered more than 4,000 agents despite explicit policies against their use. Gartner data referenced by RSA projects a typical Global Fortune 500 company running roughly 150,000 AI agents by 2028, up from fewer than 15 in 2025, while only 13 percent of organizations report adequate governance in place.

Shadow AI management forms a central focus. IBM 2026 Cost of a Data Breach Report figures indicate shadow AI incidents add between $670,000 and $5.39 million to breach costs compared with standard incidents, and the share of breaches involving shadow AI rose from 20 percent to 43 percent between 2025 and 2026. RSA positions every agent with a named human owner and lifecycle state, extending human IAM and IGA practices to agentic systems.

The product ships in three modules that can run standalone or inside the RSA Unified Identity Platform. Discover inventories agents and MCP servers through connectors to CrowdStrike, Zscaler, Entra ID, Okta, and AWS IAM. Secure applies real-time controls at an AI or MCP gateway that supports RSA-hosted, private-cloud, on-premises, or air-gapped deployments. Govern, scheduled for the first half of 2027, adds continuous certification and risk-based access reviews.

Core Capabilities, Availability, and Limitations

Secure module features include zero standing privilege, per-call and per-argument policy checks, out-of-band human approval using phishing-resistant credentials for high-risk actions, and an immediate kill switch. Govern will map logs to more than ten frameworks such as NIST AI RMF 1.0, ISO/IEC 42001, NYDFS Part 500, DORA, EU AI Act, and FINRA rules, with direct SIEM streaming and attributable audit trails. Sovereign control options cover US and EU data residency, with a fully air-gapped self-managed control plane planned for later releases.

Discover and Secure reached general availability on November 16, 2026. As of October 20, 2026, no independent third-party reviews or detailed customer deployment outcomes exist because the initial modules had not yet reached production use. Pricing details remain unavailable from RSA public materials at this stage.

Strengths include the emphasis on human accountability and customer-controlled enforcement rather than vendor-cloud models. Potential drawbacks center on the phased rollout of Govern and the absence of published performance benchmarks for high-volume agent environments. Organizations must still integrate connectors and define risk tiers manually during initial deployment.

Compared with general-purpose IAM tools, RSA Agent ID adds agent-specific inventory and gateway controls that standard service-account management lacks. It differs from cloud-native agent platforms by supporting air-gapped operation and mapping directly to multiple compliance frameworks out of the box.