Businesses are moving quickly to deploy AI agents and automated workflows, but security controls may not be keeping pace. A new report from identity security company SailPoint describes this gap as an AI “velocity paradox”: organisations are pursuing AI-speed operations while still relying on slower, human-centric security processes.

What happened

According to SailPoint’s “Horizons of Identity Security” report, enterprises are increasing their use of autonomous AI systems and automation, but many still depend on legacy identity and access management approaches designed for traditional human users and manual approvals.

The core argument is that this mismatch can create new exposure. If AI agents, automated services and machine identities receive broad access without modern controls, companies may struggle to monitor who or what is taking action across business systems.

The source is a vendor report, so its conclusions should be read as the company’s assessment rather than as an independent regulatory or enforcement finding. However, the issue it raises is consistent with a wider business concern: AI adoption changes how access, authentication and oversight need to work.

Why it matters for European businesses

For European companies, the practical issue is not only cybersecurity but also operational control, governance and compliance. AI tools increasingly connect to CRM platforms, finance software, customer support systems, internal knowledge bases and cloud infrastructure. When these systems are linked through agents and automation, weak identity controls can lead to excessive permissions, poor auditability or unintended actions.

This matters in several areas:

• Cybersecurity: compromised accounts, tokens or over-privileged service identities can become a route into critical systems.
• Data protection: AI systems may access personal or sensitive business data, making access governance relevant for GDPR compliance and internal accountability.
• Operational resilience: an autonomous workflow acting on incorrect permissions can disrupt business processes at scale.
• Regulatory readiness: businesses facing sector rules, customer audits or broader cybersecurity obligations may need clearer controls over non-human identities and automated access.

For SMEs, the risk often appears in simpler forms: connecting AI assistants to email, file storage, e-commerce systems or marketing platforms without fully reviewing permissions, logging and approval workflows.

Who may be affected

The issue is most relevant for organisations that are actively adopting AI and automation in day-to-day operations, including:

• companies deploying AI agents for internal tasks or customer operations
• e-commerce businesses connecting AI tools to product, order or customer systems
• marketing teams using AI platforms with access to analytics, campaign or CRM data
• IT and security teams managing growing numbers of service accounts, API keys and machine identities
• regulated businesses that need stronger audit trails and access governance

Larger enterprises may face the most complex identity sprawl, but mid-sized companies can also be exposed if AI tools are introduced quickly through SaaS integrations without central oversight.

What companies should consider

European businesses expanding their use of AI should review whether security processes still assume every important action is initiated by a human user. In practice, that may no longer be true.

• Map AI access: identify which AI tools, agents and automations can access business systems, data stores and third-party platforms.
• Review permissions: reduce unnecessary privileges for service accounts, integrations and agent-based workflows.
• Strengthen identity governance: make sure non-human identities are inventoried, monitored and, where possible, tied to clear ownership.
• Improve logging and oversight: ensure important automated actions can be traced and reviewed.
• Check vendor and SaaS integrations: assess how external AI tools authenticate, what data they can reach and how access can be revoked.
• Align AI and security teams: adoption projects should include identity, access and risk review early rather than after deployment.

The broader message for business leaders is straightforward: AI can accelerate operations, but the security model around it must also evolve. Companies that automate faster than they govern access may increase both cyber risk and compliance pressure.