AI agent identity crisis forces enterprise security rebuild

Rig Security has emerged from stealth with $12 million, positioning itself alongside Baselayer, which recently raised $35 million. Both startups appear to be addressing a challenge that has gained urgency in recent months: distinguishing AI agents from human users in enterprise systems.

The issue reflects broader tensions in enterprise security. Earlier coverage noted that legacy controls were designed for human users or static applications, not autonomous agents that may operate across multiple systems. When AI agents execute workflows, they can create audit trails indistinguishable from human activity, complicating oversight. Some observers describe this as "identity sprawl," where synthetic identities proliferate without clear mechanisms to verify them.

Baselayer’s approach reportedly involves identity verification, while Rig’s solution seems to focus on behavioral monitoring. These differing strategies suggest the market is still defining how to address the problem. The funding rounds may indicate investor confidence in the need for new tools, though it remains unclear whether these solutions will scale or become foundational infrastructure.

The timing of these developments aligns with shifts in how enterprises approach AI adoption. Earlier discussions emphasized trust and human acceptance, but recent trends suggest a pivot toward technical controls. Whether this reflects a broader shift in security priorities or a temporary gap in existing tools is still uncertain.

What also remains unclear is how these solutions will serve different segments of the market. Enterprise-focused tools may not address the needs of smaller businesses, which could face similar challenges with off-the-shelf AI agents. The market’s trajectory may depend on whether identity verification becomes a niche feature or a core security requirement.

The open question is whether the username and password era is giving way to a new model—or if enterprises are still searching for the right answer to the question: Who—or what—is allowed to do this?

Sources: siliconangle.com