Opal Security Launches Opal Zero to Make Least Privilege a Reality for Enterprise AI Agents

Opal Labs said more than 96% of non-human identities lack a recorded purpose, while only 10% of their access permissions were reviewed over the past year. As enterprises accelerate adoption of AI agents, the report highlights growing identity-governance and least-privilege risks, including the need for expiring access grants and accountable owners for each agent.

Analysis

This is directionally supportive for identity-security budgets, but the survey statistic is not independently sufficient to underwrite a near-term revenue inflection. The more investable implication is that agent deployment shifts identity spending from periodic governance projects toward continuous authorization, machine-identity discovery, privileged-access management and audit workflows. CyberArk (CYBR) is the clearest direct beneficiary through privileged access and machine-identity exposure; Okta (OKTA) benefits if agent-specific authentication expands seat and transaction volumes, while CrowdStrike (CRWD) and Palo Alto Networks (PANW) can bundle identity telemetry into broader platform consolidations.

Over the next 1-3 months, earnings commentary on AI-agent security attach rates is a more meaningful catalyst than enterprise surveys. The competitive risk is that hyperscalers—Microsoft (MSFT), AWS and Google—absorb basic agent permissions into native cloud-control planes, compressing standalone identity-vendor pricing; standalone vendors need to demonstrate cross-cloud governance, legacy-app coverage and measurable reduction in audit labor. The likely six-to-18-month winner is the vendor owning the policy layer across human, workload and agent identities, not necessarily the vendor with the strongest endpoint product.

Consensus may overestimate the immediacy of spend: many enterprises will initially contain agents within limited workflows rather than launch broad remediation programs. That favors incremental platform-module adoption over a sharp new security-budget cycle. A sustained re-rating for CYBR or OKTA requires disclosed machine-identity ARR, net retention improvement, or raised guidance—not generic AI-security demand language; absent these metrics, elevated cybersecurity multiples leave downside on any weaker billings print.

Key Decisions for Investors

• Maintain a 3-6 month watch-to-long bias on CYBR rather than chase on this item alone; initiate only if management quantifies machine-identity/agent-security bookings or raises forward billings guidance. Thesis is falsified by slowing subscription growth or evidence that cloud-native controls are winning cross-cloud deployments.
• Use a 6-12 month pair trade framework: long CYBR / short OKTA only after relative valuation and earnings-date review. CYBR has the more direct privileged-access monetization path, while OKTA faces greater risk that identity features become bundled; exit if OKTA shows materially faster large-enterprise net retention or agent-related upsell.
• Monitor PANW and CRWD quarterly calls for identity-module attach and AI-security platform pricing. Do not treat this as a standalone catalyst for either name: their upside requires identity controls to expand platform consolidation rather than merely displace point products at lower price points.
• Set an alert around enterprise AI-governance regulation, material agent-related breaches, or new Microsoft/AWS agent-permission offerings over the next 6 months. A high-profile breach could accelerate remediation demand for CYBR and PANW; comprehensive hyperscaler-native controls would weaken the standalone-vendor thesis.