The gap between agent enthusiasm and agent deployment has a number now, and it's ugly. At RSAC 2026, Cisco President Jeetu Patel told VentureBeat that 85% of enterprises are running agent pilots while only 5% have reached production — an 80-point gap. Matt Caulfield, VP of Identity and Duo at Cisco, argues the bottleneck is identity infrastructure built for a different era, not the agents themselves. Cisco's answer is a six-stage identity maturity model paired with an architecture that treats agents as first-class identity objects rather than service accounts borrowing human credentials. The Duo agent identity platform gives each agent its own policies, authentication requirements, and lifecycle management. Enforcement runs through an AI gateway that handles both MCP and traditional REST/GraphQL traffic: when an agent makes a request, the gateway authenticates the user, verifies the agent is permitted, encodes authorization into an OAuth token, and inspects the specific action in real time before letting it proceed. The discovery half of the problem is getting solved by acquisition rather than protocol. Cisco's Zero Trust for Agentic AI white paper describes AI agents as a rapidly growing class of non-human identities that must be discovered, governed, and mapped to accountable owners — and warns that without continuous discovery and lifecycle governance, agents become unmanaged actors with unclear ownership and limited auditability. That's the gap Cisco is trying to close by acquiring Astrix Security, a startup whose behavioral engine — trained on years of real-world API traffic — already does real-time inventory of agents, MCP servers, and non-human identities. What's notable isn't any single feature but the crowding: five vendors — Cisco, CrowdStrike, Palo Alto Networks, Microsoft, and Cato Networks — shipped competing agent identity frameworks at the same conference, and the Cloud Security Alliance separately published an NIST AI RMF Agentic Profile in April 2026 proposing autonomy-tier classification and runtime behavioral metrics. The non-human identity market is consolidating fast: CrowdStrike spent $627.9 million on SGNL in January for dynamic access orchestration, and Oasis Security raised $120 million the same period to build identity governance for machine and agent accounts. None of this settles the underlying question of who actually owns an agent's actions when it's spun up, delegated to, and retired within hours. But the 80-point gap Patel cited is a concrete signal that enterprises aren't holding back on ambition — they're holding back because nobody can yet answer 'which agent did that, and who authorized it' with confidence. Identity vendors are racing to be the ones who can.