Phishing, over-privileged admins, and AI agents with access that never expires are now the easiest way in. Score your identity risk in five minutes, see your modeled exposure, and find out what to fix first.
Certified US-based Okta engineers who answer the phone · (213) 545-0601
The risk isn’t the AI itself. It’s what the agent can reach, how long it keeps that access, and who sees what it retrieves. These six patterns show up again and again.
Agents ask for access faster than anyone can review it. People click "approve" on every prompt just to get the agent working.
The fix: Policy-level access control that decides which scopes are auto-granted, need approval, or are never allowed.
Credentials outlive the job they were issued for. An agent set up for one quarterly task keeps its access all year.
The fix: Token vaulting with automatic rotation, plus scheduled access reviews and expiring credentials.
One agent hops between CRM, email, cloud, and code. If its identity is stolen in one system, the attacker can move into the others.
The fix: Standards-based token exchange that carries the real user’s identity into every system the agent touches.
Agents spawn sub-agents, and each one inherits the parent’s elevated access without its own approval.
The fix: Human approval for privileged actions and limits on how far access can be handed down.
Wire transfers, production deploys, and account deletions can’t be undone. Nothing separates “read data” from “delete production.”
The fix: Out-of-band, human-in-the-loop approval with the full context before any high-risk action runs.
One agent serves a whole team or many customers at once, and shows one person data only another person should see.
The fix: Fine-grained authorization that filters records before they ever reach the agent.
Most risk calculators stop at “Do you have MFA?” This one also looks at privileged access, unmanaged devices, apps outside SSO, and the AI agents acting on your users’ behalf. See your Identity Risk Score, your modeled exposure, and what modernizing your identity layer could return.
Okta FastPass, passkeys / FIDO2 security keys, or smart cards. SMS codes, push approvals, and one-time codes don't count.
How widely admin and critical-system access is granted across your team.
Are only managed, healthy devices allowed to sign in?
AI assistants, copilots, and automations that can act on behalf of your users are identities too.
These modeled assumptions drive the dollar figures. Replace them with your own data for a sharper estimate.
A modeled estimate of exposure, not a prediction of loss.
2 of 9 controls in place · modeled agent exposure $14,583/yr
This calculator produces modeled estimates of identity risk exposure, not predictions of loss. Every formula and assumption is shown below so you can see exactly how each number is derived, and adjust anything that doesn’t fit your organization. Default assumptions are illustrative starting points, not published industry benchmarks.
Users × B × A × P × I
500 × 4% × 0.60 × 1.5× × $25,000 = $450,000
Users × B × A₂ × P₂ × I
A₂ assumes phishing-resistant coverage rises to 90% (for example with Okta FastPass), so A₂ = 0.10. P₂ assumes least-privilege controls remove 50% of the extra privilege exposure, so P₂ = 1.25×. This is a modeled reduction based on this methodology. It is not a claim that any product reduces breach probability by a fixed amount.
Agents × B × Authority × Control gap × P × I × 5
Your agents add $14,583, so total current exposure = $450,000 (users) + $14,583 (agents) = $464,583. Authority is the weight of the most powerful action agents can take (Read 0.1, Create 0.3, Modify 0.5, Delete 0.8, Approve 0.9, Execute 1.0). Control gap = 1 − (controls in place ÷ 9). Agents are weighted 5× a single user because they often hold broad, persistent, non-interactive access. After governance, the control gap is capped at 20%. The Agent Authorization Risk Score = 100 × Authority × Control gap × a scale factor that rises with the number of agents (about 15% at 1 agent, 50% at 9, 100% at 99 or more).
(Tickets × 12 × cost × reduction) + (Hires & departures × hours × rate)
50 × 12 × $50 × 70% = $21,000, plus 100 × 2 hrs × $60 = $12,000.
Total = (Current − Residual risk) + Operational savings
ROI = (Total − Implementation cost) ÷ Implementation cost × 100
Implementation cost is the Year 1 cost (licenses + setup) from the cost calculator on this page.
Authentication + Privilege + Devices + Applications + AI agents
Each part scores 0–20: Authentication = 20 × A; Privilege = 0 / 10 / 20 for Limited / Moderate / Broad; Devices = 0 / 10 / 20 for All / Some / None checked; Applications = 20 × share of apps outside SSO; AI agents = 20 × Agent Authorization Risk Score ÷ 100. Bands: 0–20 Low, 21–40 Moderate, 41–60 Elevated, 61–80 High, 81–100 Critical.
Drag the slider to your yearly Okta license cost. Year 1 includes setup at 20% of your license cost. After that, ongoing support is about 7%. This Year 1 cost is what the ROI above is measured against.
One-time setup (20%): $2,000
| Year | Licenses | Setup / Support | Total | Running total |
|---|---|---|---|---|
| Year 1 | $10,000 | $2,000 | $12,000 | $12,000 |
| Year 2 | $10,000 | $700 | $10,700 | $22,700 |
| Year 3 | $10,000 | $700 | $10,700 | $33,400 |
| Year 4 | $10,000 | $700 | $10,700 | $44,100 |
| Year 5 | $10,000 | $700 | $10,700 | $54,800 |
Estimate for illustration. Setup is estimated at 20% of your yearly license cost. Your final quote depends on user count, platform, and scope.
Not all agents are created equal. A customer service agent leaking data between sessions is a different problem than a coding agent pushing untested code to production. Here’s where to start for each.
A well-built agent with no governance is invisible shadow AI. Governance with no secure-by-design agents is policy with no enforcement. You need both layers, and we implement both.
Build identity into each agent from day one so it can move from pilot to production safely.
Give IT and security one control plane to see, scope, review, and shut off every agent.
Treat every agent like an employee: discovered, owned, scoped, reviewed, and revocable. If you can’t check a box below, that’s where your agent risk lives.
First-class service, start to finish. Our certified US-based Okta engineers own every step, so you can rest easy knowing your identity layer is done right. No long-term contracts.
We review your users, admins, apps, devices, and AI agents and score where identity risk is highest.
You get a short, ranked plan: what to fix first, what it costs, and what it reduces.
Our US-based Okta engineers roll out FastPass, SSO, lifecycle automation, and agent governance.
We keep watching: access reviews, agent inventory, and support from engineers who answer the phone.
How the score works, what the numbers mean, and why AI agents belong in your identity program.
An identity risk assessment looks at who and what can sign in to your systems, how they prove who they are, and how much access they have. It covers employees, admins, devices, apps, and non-human identities like AI agents and service accounts, then ranks the gaps by how much risk they create.
The score adds up five areas, each worth 0 to 20 points: authentication, privileged access, device trust, apps outside single sign-on, and AI agent authorization. A total of 0–20 is Low, 21–40 Moderate, 41–60 Elevated, 61–80 High, and 81–100 Critical.
No. It is a modeled estimate of annual exposure based on the assumptions shown in the methodology section. It is meant to compare scenarios and prioritize work, not to predict a specific loss. You can change every assumption to match your own data.
Phishing-resistant MFA, such as Okta FastPass, passkeys, and FIDO2 security keys, can’t be tricked into working on a fake login page. SMS codes, push approvals, and one-time codes can. That makes the share of users on phishing-resistant sign-in one of the biggest drivers of identity risk.
AI agents sign in, hold credentials, and take actions on behalf of people, often with broad access that never expires. Without an owner, scoped permissions, approval for risky actions, and a way to revoke access instantly, a single compromised agent can reach many systems at once.
Authorization drift is when access outlives the reason it was granted. For AI agents, that usually means long-lived tokens or API keys that keep working months after the task ended, which gives attackers a quiet way in if those credentials are stolen.
Iron Cove is a certified Okta partner with 300+ Okta deployments. We assess your environment, give you a prioritized plan, implement phishing-resistant sign-in, SSO, lifecycle automation, and AI agent governance, and then support it with US-based engineers. There are no long-term contracts.
Free 30-minute call. No pitch deck. Just honest answers from engineers who’ve done 300+ Okta deployments.
Okta, Okta FastPass, Okta for AI Agents, and Auth0 for AI Agents are trademarks of Okta, Inc. Iron Cove Solutions is an independent Okta partner. Statistics marked “Okta” or “as cited by Okta” come from Okta’s white paper “AI Agents in the Enterprise: The Security Risks Leaders Can’t Afford to Miss.” Calculator results are modeled estimates, not predictions of loss.
© 2026 | Iron Cove Solutions| Privacy | Simplifying Cloud-Based Intention