TL;DR
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
RSA CEO Greg Nelson says banks are struggling to identify all the AI agents operating in their systems, and argues that oversight should focus on each agent’s permissions, risk and accountable human owner. PYMNTS reported that RSA found 4,000 agents at a midsize bank that had told the company it had none; the bank was not named, and the figure does not establish how many agents lacked controls.
RSA Security CEO Greg Nelson is warning banks that they may not know how many AI agents are operating in their systems, as the company applies its identity and access-management work to software agents. In a conversation with PYMNTS CEO Karen Webster, Nelson said the priority is to identify agents, link each to a responsible person and scrutinize those with permissions to carry out consequential work. The report describes a midsize bank that told RSA it had no agents, but RSA found 4,000 operating inside the institution; the bank was not identified, and the figure does not show how many were unsupervised.
Nelson said that about 40 customer meetings in the preceding 30 days had surfaced uncertainty about how many agents were already in use. He told Webster: “I haven’t found one company yet that is comfortable that they know how many agents they have.” The observation reflects what he said he had heard in those meetings; it is not a published survey of the banking sector.
Nelson said an agent should have a human owner and should not have more authority than that person. The degree of oversight should depend on the tasks and permissions involved. As an example of work that merits close review, he said: “If an agent’s looking to wire $50 million, you do not just want that to naturally occur.” The example is hypothetical, not a report of an agent attempting a transfer.
RSA has announced Agent ID, a product intended to help institutions discover agents, manage their access and establish accountability. The report says Nelson sees a need for visibility across cloud applications, on-premises systems, mainframes and isolated environments. It does not provide product performance data or independent evidence about how widely Agent ID has been deployed.
Permissions Matter More Than Agent Counts
The reported discovery of thousands of agents at a bank that believed it had none points to a potential inventory and governance gap. But a count alone does not establish risk: as Webster put it, the question is not only how many agents exist, but what they can do. An agent with access to consequential financial or operational actions calls for a different level of review from one performing routine work.
Nelson also raised the risk of approval processes becoming perfunctory. If employees receive many requests and approve them in batches, a formal human checkpoint may not amount to a meaningful review. Banks face a practical balancing act: controls must give people time to examine high-impact actions without making routine approvals so burdensome that staff look for ways around them.
Accountability also has to continue after an agent is set up. Nelson said an agent may remain active with permissions intact after the employee responsible for it leaves. A bank that cannot connect an agent to a current owner or retire its access when work ends may have difficulty understanding or controlling its activity. The report does not establish that the unnamed bank had such agents or that a breach occurred.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
FLEXISPOT Mochi-Pro Zero-Wall Oversized Power Recliner, Beige
Canon PIXMA PRO-200S Wireless Professional Inkjet Photo Printer
As an affiliate, we earn on qualifying purchases.
RSA Extends Identity Controls to Agents
RSA has worked in identity and access management for more than 40 years, according to the report, including tools familiar to workers who used RSA SecurID key fobs to log in. Nelson, who became CEO in September 2025 after serving as president and chief business officer, is now applying that experience to software agents that can act within organizational systems.
The report frames the challenge as one of managing agents already in use, not only approving new deployments. Nelson cautioned that simply banning tools could push employees toward applications outside a bank’s oversight. He argued instead for discovering what is in place, connecting agents to accountable people and governing permissions according to risk. That is RSA’s stated approach, as well as the rationale for its Agent ID announcement.
Nelson suggested the bank with 4,000 agents might have 20,000 within a year. That is a projection he offered, not a confirmed forecast or an independently verified count. The report gives no further information about the bank’s size, its agent inventory methods or the controls already applied to the agents it had.
“I haven’t found one company yet that is comfortable that they know how many agents they have.”
— Greg Nelson, RSA Security CEO, speaking to PYMNTS CEO Karen Webster
The Bank’s Controls Remain Unknown
The report does not name the midsize bank or explain how RSA counted its 4,000 agents, what systems were included, or what the institution classified as an agent. It also does not say how many agents had access to sensitive systems, how many performed high-impact tasks or whether any were operating without appropriate supervision. The reported discovery is evidence of an inventory mismatch, not evidence by itself of a security incident.
There is no independent data in the source establishing how common this problem is across banks. Nelson’s comments about customer meetings and a possible increase to 20,000 agents at the unnamed institution are attributed observations and projections. The report also does not detail Agent ID’s capabilities, deployment status, effectiveness, pricing or regulatory approvals.
Banks Face Discovery and Review Work
The next practical steps described by Nelson are to discover agents already in use, identify a person accountable for each one, compare its permissions with that person’s authority and match oversight to the agent’s work. Banks would also need processes to revisit access when duties change and to disable or retire agents when their work or owner ends.
The source does not give a timetable for broader bank reviews or for Agent ID deployments, and it does not identify a regulatory deadline tied to the announcement. Further information about the unnamed bank, its controls and RSA’s product implementation would be needed to assess how much risk the discovery represented and whether the proposed tools address it.
Key Questions
What did RSA report finding at the midsize bank?
RSA reportedly found 4,000 agents operating at a midsize bank that had told the company it had none. The bank was not named, and the report does not explain how the agents were counted or what controls covered them.
Does the reported agent count mean the bank was exposed to a breach?
No breach is reported in the source. The count indicates an apparent gap between the bank’s stated inventory and RSA’s discovery, but it does not show that agents were unsupervised or that any harmful action occurred.
What controls does Nelson say banks should apply?
Nelson said each agent should have an accountable human owner, should not have more authority than that person and should receive oversight proportionate to its tasks and permissions. He also said banks need to retire an agent’s access when its work or responsible employee ends.
What is RSA Agent ID?
RSA has announced Agent ID as a tool intended to help institutions discover agents, manage their access and establish who is responsible for them. The report does not provide independent performance results or details about deployment.
Source: pymnts.com
