RSA launches Agent ID for regulated AI agent control

RSA has launched Agent ID, a security platform for managing AI agents in regulated industries, aimed at organisations including banks, government bodies and utilities.

Agent ID is designed to discover, secure and govern AI agents across their lifecycle, including authorised systems and so-called shadow agents created without formal oversight. According to RSA, the platform can identify agents and MCP servers across identity, cloud, endpoint and gateway sources, then register them with a named owner, risk tier and lifecycle state.

The launch comes as companies face closer scrutiny over how AI systems are deployed and controlled. RSA cited Gartner research forecasting that a typical Global Fortune 500 enterprise will run about 150,000 AI agents by 2028, up from fewer than 15 in 2025, while only 13% of organisations believe they have suitable agent governance in place.

IBM research cited by RSA found that incidents involving shadow AI cost an average of USD $670,000 more than standard incidents. RSA also noted that US federal agencies introduced 59 AI-related regulations in 2024, more than double the previous year.

Identity focus

RSA's approach treats AI agents as identities that hold credentials, carry entitlements and act on systems of record. Agent ID has been added to the RSA Unified Identity Platform, which already manages workforce identities, although the new modules can also be deployed separately.

The platform has three main components. Discover is intended to find known and unknown agents and register them as formal identities. Secure applies policy at an AI or MCP gateway and requires a named, authenticated operator to approve high-risk actions using a phishing-resistant credential. Govern is designed to handle certification, access reviews and lifecycle automation for agents in the same way organisations review human access.

A central part of the launch is what RSA describes as sovereign control. The AI and MCP gateway can run in cloud, hybrid or on-premises environments, selected on a gateway-by-gateway basis, and when the gateway is hosted in a customer's environment, policy decisions can also be made there. Tenant data can remain in a customer-selected US or EU region, while evidence of enforcement can be streamed into security information and event management systems.

That positioning reflects demand from regulated sectors for tighter control over data, access and operational accountability. RSA also said organisations can use the platform alongside their existing identity provider rather than adopt a single identity ecosystem.

Regulated demand

Greg Nelson, Chief Executive Officer of RSA, said the company sees pressure building from AI adoption, sovereignty requirements and board-level scrutiny of security decisions.

"Three forces are converging on our customers at once: AI that moves faster than the teams meant to watch it, a hard requirement to keep control of data and decisions at home, and boards that now own security outcomes directly," Nelson said.

"For government, financial services, and critical infrastructure, getting agentic security wrong is not inconvenient, it is catastrophic. Hope won't control agents, but RSA Agent ID will. RSA Agent ID brings agents under the same identity discipline RSA has applied to human access for decades, and it maintains control where it belongs: with the customer, in the customer's own environment," he said.

Jim Taylor, President and Chief Product and Strategy Officer at RSA, said the company is trying to address a governance gap created by the rapid arrival of AI agents in business systems.

"Agents skipped every process built for people: no registration, no owner, no accountability," Taylor said.

"To secure agents, organizations must secure their identities. RSA Agent ID finds agents across your environment, known and unknown, gives each a first-class identity with a named owner, proves the authority behind every consequential action, and hands examiners evidence they already know how to read. It is the same exacting identity standard that secures the most demanding organizations in the world, applied to a new kind of actor," he said.

Roy Singh, RSA AI Advisor and Chief Executive Officer of Korza, which worked with RSA on the development of Agent ID, said regulated institutions need to keep direct control over agent governance and authorisation decisions.

"AI holds enormous potential to improve productivity and create value in regulated institutions, but it has to be deployed responsibly," Singh said.

"Organisations cannot simply outsource agent governance and authorization to a cloud provider; they need to retain control over what their agents are allowed to do. Those decisions should be made within the organization's own environment, with a named person accountable for actions that carry real consequences. As governments and regulators assert greater control over data, infrastructure and decision-making, financial institutions, public agencies and other regulated organizations should demand the same level of control over their AI," he said.

RSA said Agent ID Discover and Secure will become generally available in November, while the Govern module is due in the first half of next year.