Short answer: On October 27, 2026, at its TechXchange conference in Atlanta, IBM launched a set of tools to give AI agents managed identities, scoped access and a kill switch (IBM). The centerpiece is Agent Identity, which works with HashiCorp Vault to record who owns each agent, what it is allowed to do and to revoke access in real time. IBM framed the launch around a Gartner projection that the average Fortune 500 enterprise will use more than 150,000 AI agents by 2028, and its own figure that only 13% of organizations believe they have the right agent governance.

Key Takeaways

• Agent Identity + Vault 2.2: owned identities, short-lived credentials and real-time revocation for agents.
• watsonx Orchestrate Discover, Contain, Evaluate: find agents across Amazon Bedrock, Microsoft Foundry and Google Gemini, run them in sandboxes with a kill switch, and test them before deployment.
• Cost tracking per agent by model and token use is part of Evaluate.
• 150,000+ agents per Fortune 500 enterprise by 2028 (Gartner, cited by IBM).
• 13% of organizations say they have the right agent governance (IBM).

• Agent Identity: What it does: Records owner, lifecycle and authority for each agent; real-time revocation; Availability: Generally available
• HashiCorp Vault 2.2: What it does: Secured agent accounts, auto-renewed short-lived credentials, post-quantum encryption; Availability: Generally available
• watsonx Orchestrate Evaluate: What it does: Tests agents, models and MCP servers; tracks cost per agent; Availability: Generally available
• watsonx Orchestrate Discover: What it does: Finds agents on Amazon Bedrock, Microsoft Foundry and Google Gemini; Availability: Tech preview
• watsonx Orchestrate Contain: What it does: Sandboxes agents with a kill switch; Availability: Tech preview
• Integration Intelligence Hub: What it does: Gives agents context on existing systems with approvals and audit; Availability: Tech preview

What problem is IBM solving?

Most agents today run on shared service accounts or long-lived API keys. That makes it hard to say which agent did what, on whose behalf, and to stop one quickly. IBM's answer treats each agent as a non-human identity with an owner and a lifecycle, the same way companies manage employee and machine accounts. HashiCorp Vault already manages non-human identities for customers including ABN AMRO, Adobe, BlackRock, Canva, Expedia, Starbucks and Target, according to IBM.

How does it fit the wider market?

The launch follows Microsoft's October 19 move to treat agents as potential insider threats and Gartner's prediction that 25% of enterprise breaches will trace back to AI agent abuse by 2028. IBM's tools are also cross-platform: Discover finds agents built on rival clouds, and Agent Identity integrates with NVIDIA's OpenShell secure runtime. Enterprises are converging on the same model: identity, least privilege, isolation, evaluation and audit for every agent.

• Agent discovery: IBM, October 27: watsonx Orchestrate Discover; Microsoft, October 19: Microsoft Defender detects up to 60 agent types
• Identity and access: IBM, October 27: Agent Identity with Vault; Microsoft, October 19: Dynamic, task-based access controls
• Monitoring: IBM, October 27: Evaluate in production; Microsoft, October 19: Guardian Agents
• Isolation: IBM, October 27: Contain sandbox and kill switch; Microsoft, October 19: Human approval for risky actions

What should enterprises do now?

1. Inventory agents across every platform, including ones teams built on other clouds.
2. Retire shared credentials and move agents to short-lived, scoped secrets.
3. Assign an owner to every agent, with a review date.
4. Test before production for accuracy, compliance and cost per task.
5. Keep a kill switch for any agent that can change systems or data.

Related: how to secure AI agents like insiders, Gartner IT Symposium 2026 highlights and MCP enterprise guide.

Frequently Asked Questions

What did IBM announce on October 27, 2026?

At TechXchange 2026, IBM launched Agent Identity and HashiCorp Vault 2.2 to give AI agents owned identities and short-lived credentials, plus watsonx Orchestrate tools to discover, contain and evaluate agents across platforms.

What is IBM Agent Identity?

A capability that works with HashiCorp Vault to record each AI agent's owner, lifecycle status and granted authority, enforce least-privilege access and revoke access in real time if an agent attempts an unauthorized action.

How many AI agents will large enterprises run?

IBM cited a Gartner projection that by 2028 the average Fortune 500 enterprise will use more than 150,000 AI agents.

Which IBM agent features are available now?

Vault 2.2, Agent Identity, watsonx Orchestrate Evaluate, IBM Concert and Terraform policy are generally available. Discover and Contain are in tech preview.

Planning an AI agent or consulting project? Book a consultation with Deployed Labs.