AI agent identity is becoming a security discipline of its own. On October 13, 2026, US software vendor Workday announced it would acquire C1.ai, a platform specialized in managing access for AI agents in the enterprise. This deal is not a technical footnote reserved for large corporations: it points to a problem many small and mid-size businesses (SMBs) already face, often without realizing it, the moment they connect an AI agent to their email, CRM, or finance tools.
In short
- Workday signed a definitive agreement on October 13, 2026 to acquire C1.ai, an identity management platform for both people and AI agents.
- According to data cited by C1.ai in the announcement, about 95% of large US companies already run autonomous agents, but only 21%, per Deloitte research, have mature governance in place to manage them.
- Gartner ranks unmanaged AI agent proliferation as the top cybersecurity trend for 2026, ahead of post-quantum cryptography.
- For an SMB, the core question is simple: who, or what agent, has access to what, why, and for how long?
- No dedicated tool is needed to get started: an inventory of active agents and a regular review of their access rights already cut the risk significantly.
Why Workday is buying an agent-identity startup
Workday already manages the employee lifecycle (hiring, role changes, departure) for thousands of companies. With C1.ai, the vendor wants to extend that same logic to AI agents, which are multiplying across IT systems at a pace that can match, or outpace, human headcount.
C1.ai connects AI agents (and people) to enterprise systems: email, CRM, code repositories, finance tools, cloud infrastructure. The platform grants access when it's needed, then revokes it once it no longer is. Gerrit Kazmaier, a Workday executive, summed up the stakes: "today's companies run on a combined workforce of people and AI agents." C1.ai CEO Alex Bovee went further: "enterprises can't secure the AI era using yesterday's IT tickets."
The deal is expected to close in Workday's fiscal 2027 fourth quarter (ending January 31, 2027), subject to customary closing conditions. The purchase price was not disclosed.
Key takeaway
When a vendor like Workday, which already manages identity for millions of employees, invests in AI agent identity, it signals a real underlying problem: access-management tools built for people are no longer enough on their own.
A new kind of identity problem: agents don't behave like employees
An employee follows a predictable path: hired, sometimes promoted or moved to a new role, then they leave. An AI agent behaves differently, and that's exactly what makes it harder to manage.
Human identity
AI agent identity
This difference explains the finding in Gartner's 2026 cybersecurity trends report, published on February 5, 2026: the research firm names unmanaged AI agent proliferation as the top trend of the year, ahead of post-quantum cryptography risks. Gartner advises security leaders to identify both sanctioned and unsanctioned agents, apply access controls to each of them, and prepare incident-response playbooks specific to agents.
What this actually means for an SMB
An SMB does not need to buy a platform like C1.ai to start addressing this. It first needs to answer a simple question: how many AI agents are active in my business, and what can each of them do?
An agent built in an n8n workflow to sync the CRM with email, a Microsoft Copilot assistant connected to financial documents, or a customer-support agent linked to the ticketing system: each of these agents holds credentials, often with broader rights than needed, and often forgotten once the pilot project is over.
Build an inventory of active agents
Check their access rights
Assign an owner to each agent
Schedule a quarterly review
Human identity vs. agent identity: same principle, different pace
| Aspect | Employee | AI agent |
|---|---|---|
| Creating an access | Controlled HR process, often days | Minutes, sometimes without approval |
| Pace of change | Slow (role change, promotion) | Fast (new workflows created continuously) |
| Named owner | Always (the employee themselves) | Not always clear |
| Deactivation at end of use | Formal offboarding process | Often forgotten |
| Main risk | Takeover of an existing account | Overly broad access left active unmonitored |
An encouraging sign
Workday's acquisition of C1.ai shows that AI agent identity management is becoming a mature market, with enterprise-grade solutions rather than internal workarounds. Over time, SMBs should benefit from more accessible tools coming out of this consolidation.
FAQ
What is an "AI agent's identity"?
It's the set of credentials and access rights that let an AI agent (an automated script, an assistant connected to business tools) act on company systems, the same way a user account does for an employee.
Is my SMB already using AI agents without realizing it?
Very likely, if your teams use no-code tools like n8n or Make, or assistants like Microsoft Copilot connected to your documents. An inventory of active connectors and automations is the first step to take.
Do I need to buy a tool like C1.ai to secure my AI agents?
Not necessarily right away. An SMB can start with a manual inventory, a "least privilege" rule on access rights, and a quarterly review. A dedicated tool becomes worthwhile once the number of agents outgrows what a manual review can track.
Why does Gartner rank this as the top 2026 trend?
Because AI agents get created faster than they get switched off, and many slip past standard IT security controls. Gartner recommends identifying every agent, sanctioned or not, and applying clear access rules before an incident forces the issue.
To go further on securing your automations, see our guide on securing AI connectors and agents or our article on the black market for stolen AI accounts.
