Cybersecurity companies completed 219 mergers and acquisitions in the first half of 2026, on pace to exceed 400 for the year, and acquisitions specifically targeting AI security companies rose from 10 across all of last year to 29 in the first half of this year alone. The surge tracks a specific, concrete gap: enterprises are deploying fleets of autonomous agents with real credentials and tool access faster than they are building the identity, permissioning, and audit infrastructure to govern them, and government advisories have separately flagged AI agents as a growing source of gaps in identity and access management. The underlying pattern worth internalizing if you are building or deploying agents is that an agent with standing credentials and broad tool access is functionally a new identity in your systems, not just a script, and it needs the same discipline a human employee account requires: the minimum permissions necessary for its actual task, complete logging of every action it takes, human approval checkpoints in front of anything irreversible such as sending money, deleting data, or making external commitments, and regular review of what access it still actually needs versus what it was granted at setup and never had revoked. This is no longer a niche warning; it shows up as a first-class feature set in the governance layers of Google's Gemini Enterprise, NVIDIA and ServiceNow's Project Arc, and similar enterprise agent platforms shipping this same month, meaning enterprise buyers are increasingly going to expect this kind of auditability by default rather than treating it as an advanced or optional configuration. Teams shipping agent products into enterprise environments should expect security review of exactly these controls to become a standard part of the sales and procurement process, not an afterthought.