RSA Agent ID: Securing Enterprise AI Agents

At The AI Conference in San Francisco, RSA announced the launch of RSA Agent ID, an agentic identity security platform designed specifically for regulated industries such as finance, healthcare, government, and critical infrastructure. We sat down with Jim Taylor, President and Chief Product and Strategy Officer at RSA, to explore how the new platform operates.

Taylor emphasized that AI agents fundamentally change security dynamics because they are not static service accounts. When given a task with poorly worded prompts, agents will execute whatever steps they deem necessary to finish the job without ever getting tired. Furthermore, agents accumulate permissions, data, and access over time without any subsequent review from human operators.

Stock photo for illustration only, not from the actual event

The scale of the issue often shocks even highly regulated organizations. A medium-sized global bank informed RSA that company policy strictly prohibited AI agents. However, an enterprise-wide audit conducted by the security team uncovered more than 4,000 active shadow AI agents running inside their infrastructure. According to IBM data, security incidents involving shadow AI cost an average of $670,000 more than standard incidents.

Taylor highlighted a failure scenario that involved zero malicious attackers. A customer success employee asked an AI agent to pull all customer records from Salesforce to build health charts. The agent began downloading the entire database rapidly, which Salesforce defense systems flagged as a denial-of-service attack, instantly shutting down the corporate instance and issuing a severe warning.