WorkOS makes the Cyber60 as CISOs put agent identity first

Lightspeed and Fortune published the fourth edition of the Cyber60, and WorkOS made the list. The entry reads: "WorkOS provides authentication and identity infrastructure for software companies. Its platform helps developers securely connect people and AI agents to applications and data, supporting the identity requirements of enterprise software."

Making a list is nice, but the survey published alongside it is more useful. Lightspeed ran it with Wakefield Research across 200 CISOs at U.S. companies with $500 million or more in revenue, and the results are a spec sheet for the problem we work on every day.

Agents are in production, their identities are not

AI agents are running in production at 77% of the companies surveyed, and 98% are using, piloting, or exploring them.

Deploying agents isn't the hard part, but counting them is. Among companies using or exploring agents, 20% maintain a complete inventory of the agents operating in their environment, and 74% have a partial one. You can't scope access for something you haven't counted.

The authentication numbers are worse. Only 34% use or would use dedicated per-agent identities with scoped permissions. 26% pass human user credentials to agents, 15% use shared service accounts, and 26% use a mix.

Only a third of companies using or exploring agents give each agent its own scoped identity.

Few teams choose borrowed credentials on purpose. They choose the integration that already works, and a human token is the one every system downstream already accepts.

Guru Chahal, a partner at Lightspeed, named the cost of that in the report: "A quarter of these companies use or would use human credentials for agents. That can give the agent the person's permissions and leave security teams struggling to tell who did what. Agents need their own identities and limits on what they can access. CISOs put identity governance first on their list of tools to evaluate."

Agent identity is the top category CISOs plan to evaluate

Agent identity, authorization, and access governance leads every other category of AI security tooling CISOs plan to evaluate in the next 12 months, at 55%.

The threat data explains the ranking. Compromised or hijacked agents acting inside the environment is a top concern for 51% of CISOs, tied with AI-generated phishing and deepfakes. Ungoverned non-human identities and agent credentials follow at 41%, and the agent tool and integration supply chain (MCP servers, plugins, connectors) at 40%.

Adoption lags the worry. Non-human identity management has the lowest AI adoption of any category in the security stack, at 26%. The report's opportunity map for builders puts agent identity and access governance first of six areas, and calls for identity providers and directories built for agents, with per-agent credentials issued and revoked automatically, plus attribution that separates agent actions from the human whose credentials the agent may be using.

CISOs asked for the same thing in their own words. About three in ten of the 200 open-ended answers were about agents: their access, their permissions, their identities, and what they do when nobody is watching. Two of the responses the report printed:

"Easier management of agent identities and permissions so AI agents only access the systems and data they actually need."

"Better controls are needed to prevent AI agents from gradually expanding their access beyond their original permissions."

The teams holding this have less help than last year

79% of CISOs reported a confirmed or suspected AI-related security incident in the past 12 months, up from 75%. Confidence that their own team can assess and mitigate AI-specific risk fell from 71% to 55%. Security is formally involved in AI governance at 78% of these companies, down from 87%, and the share where security drives the process fell from 33% to 21%.

The machines keep acting anyway. 88% of these companies already let AI execute at least some security response actions with no prior human approval: 71% for a narrow set of low-risk actions, 17% broadly across response workflows. Budgets are following. 85% of CISOs expect security spend to grow this year, and 82% put more than 5% of the security budget into AI.

Give every agent its own identity

If you sell software into these companies, the survey is a procurement preview. The buyer on the other side of your next security review is running agents, can't fully enumerate them, has a one-in-four chance of letting agents borrow human credentials, and has already put agent identity at the top of the evaluation list.

The work is ordinary. Issue each agent its own identity and scope what it can reach. Keep its actions attributable to the agent, not to whoever's token it borrowed. We've written about what agent identity looks like in practice and how enterprises can grant agents access without a consent screen per app. Start with the inventory: agent name, owning service, scopes, last rotation. Everything else depends on knowing what's already running.