Most companies using AI agents have not fully folded them into identity management, JumpCloud survey finds

Applied to the full sample, the 36% figure is roughly 90 of the 250 organisations ^[11]. Each looked into an AI-related concern and finished without knowing what the AI had accessed ^[6]. Incident scoping starts from an access list. Without one, a team cannot say which data an agent read or which systems it could reach at the time.

The 72% finding ^[5] describes the condition behind those dead-end investigations. In our view an agent whose permissions nobody checks against its use is an unreviewed service account. We think it needs the control already applied to service accounts: an entry in the access review, a named owner, and a log that someone reads.

As reported, the research measures security and governance gaps ^[3]. The brief describes no attack on an agent, and it does not define the auditability tiers, give field dates, or say how "fully integrated" was judged. We would schedule this with routine access-review work; it does not call for emergency change.

On the platform split ^[2], 21% against 11% is a ratio of about 1.9 ^[12]. Without tier definitions, we would read it as a reason for each tenant owner to check what agent activity their audit logs record. We would not read it as a ranking of Microsoft against Google.

JumpCloud measured the gap and introduced the framework meant to close it ^[7]. Its emphasis on clear ownership, appropriate access controls and continuous auditing ^[8] is ordinary identity hygiene, in our view, and would be sound advice with or without the survey. The figures come from one vendor's survey, reported by Channel Insider and summarised in an SC World brief ^[4][9].

We think the first step fits inside the access reviews organisations already run. A review that lists every agent, its owner, its granted permissions and where its activity is logged would answer the question 36% of respondents could not ^[6].