Your agents are getting their own identity provider

In the first week of November, CrowdStrike agreed to spend about US$495 million on two AI security companies, Fiddler AI and Dreadnode. Three days later, Palo Alto Networks was reported to be in talks to buy Clutch Security for about US$500 million. Clutch controls how AI agents reach enterprise systems.

I run technology at an Australian systems integrator and managed service provider. Almost everything we do comes back to one question: who can reach what, and who approved it. So when a billion dollars moves in a week, I want to know what it is buying.

It is not buying agent monitoring. That is the easy read, but it's more than that. It is buying a directory. The question these deals are really answering is where your AI agents will hold their identities, and the answer being built is not the identity provider you already run.

What CrowdStrike actually shipped

The acquisitions are the visible part. The foundation went in two months earlier.

At Fal.Con on 2 September, CrowdStrike launched the Agentic Identity Provider inside Falcon Next-Gen Identity Security. Falcon Guardian discovers agents as they come online, and the Agentic IdP registers each one in a single directory. Each agent gets a cryptographically verifiable identity. It holds no standing credentials of its own. Access is brokered as short-lived tokens, scoped to the minimum needed for one task, and every action is tied back to the human or workload the agent acts for.

Looking a bit closer at that list; discovery, registration, a directory, credential issuance, authorisation, attribution. That is an identity provider, and CrowdStrike says so plainly. Its announcement calls the platform the identity control plane for the agentic enterprise, and argues that traditional identity providers handle agents poorly because they model them as service accounts, API keys or workload identities. SiliconANGLE's coverage quotes the company more bluntly still: traditional identity providers break when an agent acts on its own.

The identity vendors are not standing still

If you only read security press, you might think the identity incumbents have missed this; they have not, and the discovery gap is smaller than the pitch suggests.

Microsoft now discovers agents three ways. AI agent discovery in Global Secure Access inspects internet-bound traffic and marks each agent managed or shadow depending on whether it is registered in Entra Agent ID. Defender and Intune find local agents on Windows devices and list them on a Shadow AI page. Agent 365, generally available since May at USD 15 per user per month, syncs a registry that reaches agents running on AWS Bedrock and Google Cloud.

Look again at the first of those. Microsoft's definition of a shadow agent is one that is not in Entra Agent ID. Discovery feeds the directory, and the directory is the one you already govern.

Okta is the weaker case here. It has no endpoint and no inline network layer, and Forrester's recap listed the gaps, including SPIFFE-based agent identity still on the roadmap for the fourth quarter of 2026.

So the fight is not really about who can see your agents. Increasingly, everyone can. It's about where this visibility is recorded and managed.

The uncomfortable part is that they are right about the model

It might just seem like a land grab, but the technical argument holds.

Think about how your organisation handles service accounts today. Most have a secret that never expires. Most were created for a project that finished years ago. Most carry more access than the task ever needed. Almost none get reviewed, because reviewing them is nobody's job.

Now put that beside what the Agentic IdP describes. No standing credentials. Tokens scoped to one task and a short window. Every action attributable to a person or a workload. That is better than what most organisations do today, and significantly so.

Research published in the same week says the same thing from the other direction. Kantara's Digital Identity Risk Universe work found that human identity risk models do not transfer to agents, and named the failure modes: orphaned identities left after decommissioning, dormant credentials waiting to be used, and identity drift, where an agent's capability grows while its authorisation level never changes.

The model is right. The ownership needs to be figured out.

This is an org chart problem wearing a product label

Here is what I keep coming back to.

We spent fifteen years consolidating directories. Not for elegance. We did it because scattered directories produce exactly the problems everyone is now worried about: accounts nobody owns, access nobody reviews, and no single place to answer what one person can reach.

Agent identity has become the argument for undoing that.

Consider the scenario. Your people authenticate through Entra. Your agents register in a security platform's directory. You now have two directories, two joiner, mover and leaver processes, and two access reviews. When an auditor asks what a departing employee's agents could still reach, you check two systems and hope they agree.

The second question is harder than the first. Whoever owns the agent directory owns the agent access review. In most organisations that will be the security team, because the product arrives inside a security platform they already bought. It will not be the identity team that runs Entra and actually knows how your joiner, mover and leaver process works.

That split does not show up in a product comparison. It shows up eighteen months later, when nobody can say who approved an agent's access, and fingers start to get pointed.

What to ask before the choice is made for you

Most of this has no general availability date yet, which means you still have time some time to decide on your approach.

Five questions worth putting to your own teams this month:

• Where will agent identities live, and did somebody decide that, or did it follow from a product you already own?
• Who runs the access review for agents, by name, and is it the same team that runs it for people?
• What is the deprovisioning path when a project ends, and can you answer that for service accounts today?
• If agents sit outside your main directory, how do you answer one access question across both?
• What does your identity vendor commit to for agents, with dates, and what is still just a slide?

None of this needs a purchase order. It needs an hour and somebody willing to write the answers down.

We do this work for clients, and the pattern is consistent. The organisations that will handle agent identity well are the ones that already handle service accounts well. The technology is new. The discipline is not.