| View Online |  | KC INSIGHTS | | 16th September 2026 |
| Nobody Signed Off on
What’s Already RunningNew research treats shadow SaaS and shadow AI as one problem for the first time. A CISO who’s led three very different security organizations agrees.Why SaaS and AI governance are now one market | What a CISO actually trusts AI to decide | Who gets to act on behalf of your AI agents Hi Andrew, Our newest research closes a gap that has been building for years. Matthew Gardiner’s Leadership Compass and Buyer’s Compass on SaaS Security and AI Governance stop scoring these as separate markets, because AI is now delivered through SaaS and embedded inside it, and both create identities, service accounts, integrations, and agents that nobody explicitly owns. This edition’s Analyst Chat makes the practical case. Matthew Gardiner and Matthias Reinwarth walk through why most organizations still cannot say how many SaaS and AI tools are actually running inside their environment, and why discovery, not policy, is the capability everything else depends on. From the CISO seat, Michael Schrank, who’s led security at Deutsche Bank, Daimler, and Adidas, tells Berthold Kerl much the same thing from a different angle: AI is already changing what security teams can safely automate, but autonomous action only earns trust where the business context behind it is actually understood. | Market Insights | Leadership Compass + Buyer’s Compass  SaaS Security and AI GovernanceMatthew Gardiner rates vendors in a market that’s stopped treating SaaS security and AI governance as separate disciplines, evaluating how well platforms discover shadow SaaS and shadow AI alike, and whether they extend identity-based controls to AI agents as full-fledged identities in their own right. Read the Leadership Compass → Read the Buyer’s Compass → | Expert Voices | CISO Perspective  Full Steam Ahead: AI, Attackers, and Why CISOs Must Keep PaceBerthold Kerl talks with Michael Schrank about where AI is already earning measurable value in cyber defense and GRC, where it’s still overhyped, and why entry-level security roles are disappearing faster than the industry planned for. Watch Now → | | | | Analyst Chat  Shadow SaaS, Shadow AI & the Governance Gap Matthew Gardiner and Matthias Reinwarth on why SaaS Security Posture Management has quietly become the wrong frame, and why most SaaS and AI applications inside a typical organization are still invisible to the team meant to secure them. Watch Now → |
| Three Weeks Out |  AIdentity & Non-Human Identity Impact DayMachine, workload and AI agent identities at scale: a discussion on governing delegation as autonomous agents take on more of the work, based on themes from this month's agent-delegation webinar. Register Now → | Webinar Briefings | September 22  The New Workforce Identity Challenge: AI Agents, NHIs, and the IAM GapA direct continuation of this edition’s core question, for teams ready to move from “we found the agents” to “we can govern them.” Register Now → | | | | September 29  Who Gave the Agent Permission?Jonathan Care, Grace Rachmany from the Decentralized Identity Foundation, and Angelika Steinacker on scoped, revocable mandates for AI agents, and building an evidence trail that connects an agent’s actions back to whoever authorized them. Register Now → |
| KuppingerCole Analysts MembershipEvery piece of research in this edition, and a complimentary ticket to AIdentity & NHI Impact Day, come with Expert Membership. Explore KuppingerCole Membership → | |
|