Businesses adopting AI-powered software may be creating a security gap without realising it. A new industry report says many third-party products now include embedded AI agents, but a large share of those tools do not sit behind a company’s single sign-on environment. That means they can fall outside normal identity controls, visibility and governance processes.

What happened

The source article cites findings from a 2026 State of Agent Security Report covering the environments studied by the report’s authors. According to those findings, around 1,280 third-party products in those environments now embed AI, while about 282 were connected to single sign-on. The remainder were described as effectively invisible to identity infrastructure by default, not necessarily because they were intentionally hidden, but because identity systems can only govern applications and agents that authenticate through them.

These figures should be understood as report findings from the environments examined, not as a universal measure of all businesses. Even so, the underlying issue is clear: AI functionality is spreading into SaaS products faster than many organisations’ security controls are adapting.

Why it matters for European businesses

For European businesses, the issue is not only about new software features. It is about security, access control, procurement and compliance. Many companies rely on identity providers, SSO and standard application inventories to understand which tools employees use and what data those tools can access. If AI agents operate outside those controls, businesses may have an incomplete view of where company data goes, which systems are connected and who is responsible for oversight.

This matters in several practical ways:

• Security monitoring gaps: IT teams may not see agent activity in the same way they see managed applications tied into central authentication.
• Third-party risk exposure: An AI-enabled vendor tool may process internal documents, customer information or operational data without going through the organisation’s normal identity guardrails.
• Policy enforcement challenges: Access rules, conditional access and user lifecycle controls are often designed around known, integrated apps.
• Compliance implications: Businesses in regulated sectors may need clearer records of where data is processed, which suppliers are involved and what safeguards apply.

For SMEs, this is especially relevant because AI features are increasingly being added to existing tools rather than deployed as separate, clearly reviewed systems. A company may believe it has not adopted many AI systems, while in practice AI agents are already embedded across sales, support, productivity and marketing platforms.

Who may be affected

The issue is most relevant for organisations that use multiple SaaS products across departments, especially where employees can activate new AI features with limited central review.

• SMEs and founders using a growing mix of cloud tools without a dedicated security operations team.
• IT and security teams responsible for identity, access management and SaaS governance.
• Marketing and e-commerce teams working with platforms that increasingly embed AI assistants, content tools and workflow agents.
• Regulated businesses that need stronger supplier oversight, auditability and data governance.
• Digital agencies and service providers managing client data across multiple third-party platforms.

What companies should consider

European businesses do not need to stop using AI-enabled tools, but they should review whether existing controls still match how modern SaaS products behave.

• Update SaaS inventories: Review which third-party tools now include embedded AI features or agents, even if those tools were originally approved for another purpose.
• Check identity coverage: Identify which business applications are actually connected to SSO and which are not.
• Review vendor risk processes: Procurement and IT reviews should ask how AI features authenticate, what data they access and whether they create new subprocessors or external connections.
• Clarify internal AI policies: Make sure employees understand which tools and agent features are approved for handling internal or customer data.
• Prioritise high-risk functions: Pay particular attention to tools used in finance, HR, customer support, code development and marketing operations where agents may access sensitive business data.
• Align security and compliance teams: Identity management, privacy and procurement teams may need a shared process for assessing AI-enabled third-party tools.

The broader lesson is that AI adoption is no longer limited to standalone chatbot rollouts. Increasingly, it arrives through third-party platforms that businesses already use. For European companies, the operational challenge is making sure visibility, governance and supplier oversight keep pace.