Agentic AI and machine identity lead agenda as Gartner Tokyo Security Summit opens

The Gartner Security & Risk Management Summit Japan 2026 opened Wednesday at the Grand Nikko Tokyo Daiba in Tokyo's Odaiba waterfront district, drawing more than 840 CISOs and cybersecurity leaders for the first day of a three-day gathering that represents the company's primary annual security conference for the Asia-Pacific region. Seventeen Gartner analysts are presenting research-driven sessions through Friday, July 24, alongside more than 60 solution providers exhibiting on the conference floor.

The summit arrives at a moment when two security challenges have converged into a single structural problem for enterprise security teams. Agentic AI systems — software that acts autonomously, uses tools, executes code, and completes multi-step tasks without per-step human approval — are now embedded across enterprise environments. And each new AI agent creates its own credentials: tokens, API keys, certificates, and service accounts that must be governed. The result is an identity estate that is growing faster than any existing governance framework can track. Gartner's own research placed non-human identities (NHIs) — all the machine-generated credentials that are not tied to a human user — at a ratio of 45 machine credentials for every human credential in an average enterprise, with cloud-native environments running as high as 144 machine credentials per human one. Autonomous AI agents are accelerating that imbalance further, and the identity infrastructure most enterprises rely on was designed for browser-based, password-authenticated human logins — not for software that spawns credentials at runtime and operates across dozens of systems simultaneously.

That gap is the thematic core of what Gartner analysts are delivering this week in Tokyo.

"Seize the Moment": What the Opening Keynote Told APAC Security Leaders

Gartner Senior Director Analyst Oscar Isaka opened the summit with a keynote titled "Seize the Moment," framing the current environment not simply as a threat escalation but as a compressed decision window that carries real strategic opportunity for security leaders who act decisively.

Isaka identified three specific moments security leaders can act on. The first is using AI adoption — which is already happening across enterprise lines of business whether security teams are ready or not — as a lever to modernize identity infrastructure for both human and machine credentials at the same time, rather than allowing AI deployment to outpace identity governance and create an unmanaged credential sprawl. The second is reframing breach inevitability: rather than treating incidents as evidence of program failure, building continuous learning cycles from each incident so that defenses improve rather than simply react. The third is making the business case for security investment by demonstrating measurable ROI, shifting security from a cost center into a function that can justify its own expansion.

The "Seize the Moment" framing carried over from Gartner's North American SRM Summit held June 1–3 in National Harbor, Maryland, which featured 62 Gartner analysts and more than 110 research-driven sessions. The Tokyo edition adapts that research agenda for the Japan and APAC context, including the specific regulatory environment of Japan's Act on the Protection of Personal Information, cross-border data sovereignty obligations, and the particular mix of on-premises infrastructure and legacy systems prevalent in Japanese enterprise environments.

Why Agentic AI and Machine Identity Are Two Sides of the Same Crisis

The summit's six tracks treat agentic AI and machine identity as adjacent issues. They are better understood as two aspects of the same structural change.

Gartner's February 2026 Top Cybersecurity Trends research identified agentic AI governance and IAM adaptation for AI agents as two of its six defining trends for the year. The reason they travel together is architectural. An AI agent does not log in the way a human employee does. It authenticates via OIDC tokens, OAuth grants, and short-lived API credentials that it may generate or refresh multiple times per session. When a no-code platform deploys an AI workflow, each node in that workflow mints its own identity. When an agent spawns a sub-agent, the sub-agent mints another. The agent estate inside a mid-size enterprise can generate hundreds of new machine credentials per week with no corresponding process for lifecycle management.

The security failure that results is not primarily a model problem — it is a permission problem. Agents are typically granted broad access in order to function effectively: read-write permissions on CRM systems, database queries, code repositories, cloud infrastructure, and communication tools. When an attacker embeds malicious instructions in data the agent reads — a document, an email, a web page the agent fetches — the agent may follow those instructions using its own authorized tools. This is the attack class that the OWASP GenAI Security Project's 2026 State of Agentic AI Security report ranked as the number one threat, under the designation Agent Goal Hijacking (ASI01). Standard access controls do not block it because the agent is using legitimate credentials. Only behavioral monitoring — establishing what normal tool-call patterns look like for each agent, and alerting on deviations — provides reliable detection.

Session Track D at the Tokyo summit — Application and Data Security — addresses this directly through two dedicated sessions: "How to Control Security Risk of AI Agents" and an interactive "Ask the Analyst: What CISOs Need to Know About AI Agent Security." Track F's CISO Circle Workshop, "AI Security Roadmap 2026 — What Security Leaders Must Do Now and What's Next," offers senior attendees a peer-facilitated session producing concrete 12-to-18-month governance roadmaps.

Gartner's research position, consistent across its 2026 global SRM series, is that enterprises should deploy AI as an augmentation layer for human analysts — not as an autonomous replacement — while building the identity governance infrastructure that agentic AI requires. The firm projects that more than 40% of agentic AI projects will be canceled by the end of 2027, with escalating costs, unclear business value, and inadequate risk controls cited as primary causes.

How Prompt Injection Works — and Why Existing Controls Miss It

For security leaders attending Tokyo sessions on AI agent governance, the technical mechanism behind the dominant attack vector warrants a precise explanation.

Prompt injection exploits a structural property of large language model agents: the model has no syntax-level mechanism for distinguishing instructions issued by its operator from content encountered in the environment it is operating on. A human developer can tell the difference between a command-line instruction and a file she is reading; an LLM agent cannot reliably make the same distinction once an attacker has crafted the environmental content to look like instructions. The attacker's payload does not require network access, a compromised credential, or code execution. It requires only that the agent read a file, a web page, or an API response that has been modified to include adversarial instructions.

The enterprise risk this creates is direct. An email-reading agent granted permissions to send replies can be redirected by an injected instruction to forward inbox contents to an external address. A data-query agent can be directed to dump entire tables rather than the specific records it was asked to retrieve. A coding agent can be instructed to install a persistence mechanism via its code-interpreter tool. In every case, the agent uses its own authorized credentials — so network-layer access controls do not trigger. Only behavioral monitoring, detecting that the agent is performing an action outside its normal pattern, provides a detection layer.

Gartner's Track E session "How to Manage Risk From IT Vendors With AI/Agentic AI Services" addresses a related but distinct exposure: the third-party risk introduced when an enterprise's own AI environment integrates with vendor AI and agentic services, each of which brings its own permission surface and behavioral profile.

The scope of the exposure has become measurable. IBM's cost-of-breach data puts a specific figure on unsanctioned AI risk: organizations with high levels of unmanaged AI deployed incurred on average $670,000 more per breach incident compared to organizations with low or no shadow AI.

Tokyo's Vendor Floor: Identity, Data Sovereignty, and Post-Quantum Architecture

More than 60 solution providers are exhibiting at the Grand Nikko Tokyo Daiba across security categories that map directly to the summit's analyst research tracks.

CyberArk opened Day 1 with a theater session on unified identity security, presenting its "Discover, Control, and Govern" framework as a response to the multi-category identity challenge: human user access, machine identities covering APIs and automation systems, and the new category of autonomous AI agent identities. The session addressed Identity Threat Detection and Response (ITDR) as a real-time risk detection layer, including use cases around eliminating excess privileges across all three identity categories and automating threat blocking when anomalous behavior is detected.

KnowBe4's theater session made a complementary argument from the organizational rather than the technical side: as AI environments grow more complex than rigid risk management frameworks can handle, organizations must shift to what the company calls "Resilience Management" — a model built on cultivating trust between human employees and the AI systems they work alongside, rather than trying to enumerate and control every possible AI behavior.

Thursday's agenda at the summit includes a session from Thales Japan, scheduled for 1:15 PM to 1:45 PM local time, on Data Security Posture Management and data sovereignty architecture. Yasuhiro Funaki, Senior Sales Engineering Manager at Thales Japan, will present a framework for achieving data sovereignty by managing encryption keys independently from cloud infrastructure — the argument being that separating key management from the cloud provider makes data effectively unreadable even in the event of a breach or a government compelled-access request. The session includes a live demonstration of a post-quantum cryptography (PQC)-ready sovereignty architecture, making it one of the most technically specific sessions in the vendor lineup.

That PQC emphasis connects directly to a Gartner research finding being presented this week: the firm predicts that advances in quantum computing will render the asymmetric cryptography most organizations currently rely on — RSA, elliptic-curve cryptography — unsafe by 2030. The APAC context gives this finding added urgency. Japan's National Institute of Information and Communications Technology (NICT) has completed the SecureBridge pilot, which validated hybrid post-quantum authentication using smart cards in healthcare settings. Hybrid approaches — combining current classical algorithms with post-quantum alternatives — are the dominant enterprise transition strategy, given that full migration requires a comprehensive cryptographic inventory that can itself take 12 to 24 months for a large organization.

Only 38% of organizations globally report actively preparing for the post-quantum shift, according to a 2026 study from Entrust and the Ponemon Institute. In Singapore specifically — a major financial hub for the APAC region — fewer than a third of cybersecurity leaders say their organizations are actively preparing, despite nearly half of those surveyed believing a cryptographically relevant quantum computer will arrive within five years.

How Does AI Change the Security Operations Center?

Track E at the Tokyo summit — Cybersecurity Operations and Response — directly addresses how SOC teams are being restructured under AI pressure.

The "Outlook for SOC: The Ultimate Cybersecurity Remix" session presents Gartner's research on why the era of the siloed Security Operations Center is ending. The session's argument is that incident response, threat hunting, and continuous exposure management are no longer separate functions running on separate timelines — they must be integrated into a single, synchronized operational ecosystem. That integration is what Gartner's research labels Continuous Threat Exposure Management, or CTEM: a five-stage cycle (scoping, discovery, prioritization, validation, mobilization) that replaces point-in-time vulnerability scanning with an ongoing program.

The SIEM Magic Quadrant session — presenting Gartner's annual vendor evaluation for Security Information and Event Management platforms — is among the most commercially consequential sessions of the Tokyo event. Gartner Magic Quadrant results typically drive enterprise vendor evaluation and purchasing decisions for 12 months after publication. The 2025 SIEM Magic Quadrant, published October 2025, included Securonix, Splunk, and other established players; the Tokyo session will present the 2026 edition.

Track C's session on Cybersecurity Mesh Architecture (CSMA) addresses the infrastructure counterpart to the SOC's operational transformation. CSMA is Gartner's architectural framework for distributing security controls across hybrid environments — spanning on-premises, cloud, and edge infrastructure — through four integration layers: security analytics and intelligence, a distributed identity fabric, consolidated policy and posture management, and unified dashboards. The practical implication for Japanese enterprise security teams, many of whom operate complex hybrid environments with significant legacy infrastructure, is that the path to zero trust does not require ripping out existing systems — it requires integrating them into a coherent mesh.

CISO Circle and Executive Governance Programs

The CISO Circle program — a by-application executive track running parallel to the main conference — is designed specifically for CISOs and Chief Risk Officers. Two workshops anchor the executive track. The first, "AI Security Roadmap 2026 — What Security Leaders Must Do Now and What's Next," runs participants through a peer-facilitated process for building a concrete AI security governance roadmap covering immediate priorities and a 12-to-18-month planning horizon. The second, "Modernising for Organisational Resilience," examines how CISOs are restructuring their security organizations and technology stacks to achieve durable resilience.

The CISO Circle's structure reflects a consistent Gartner finding across the 2026 global SRM series: the most time-sensitive governance challenges are not primarily technical — they are organizational. Who is accountable when an AI agent takes an action that causes harm? What decision rights does a CISO have over AI deployments made by a business unit without security review? How does a security team build the board-level credibility to govern AI investments it did not initiate? These questions do not have technology solutions; they require governance frameworks and executive alignment, which is what the peer-based CISO Circle workshops are designed to produce.

Attendees can schedule private 30-minute one-on-one analyst meetings with Gartner's Tokyo analyst team — a service available exclusively to full-conference registered attendees and regarded by many participants as the highest-value offering the summit provides. Select sessions also carry CPE credit eligibility toward ISACA and other professional certification bodies.

What Comes After Tokyo

The Tokyo summit is the second stop on Gartner's 2026 global SRM circuit. The São Paulo edition runs August 4–5 in Brazil, and the London edition closes the series September 22–24. Each regional edition adapts Gartner's core research agenda — agentic AI governance, identity modernization, post-quantum readiness — to the specific regulatory, infrastructure, and threat context of its market. London's agenda, for instance, lists sessions specifically on navigating NIS2, DORA, and the EU AI Act alongside deepfake identity impersonation attacks.

For APAC security leaders who could not attend, the most actionable output of the Tokyo sessions will be Gartner's research documents, distributed through the Conference Navigator platform. Those documents — including the SIEM Magic Quadrant and any updated Hype Cycle research released in conjunction with the event — will shape vendor shortlists and budget allocations across the APAC enterprise security market through mid-2027.

The summit continues through Friday, July 24.

Frequently Asked Questions

What is agentic AI, and why is it the top security risk Gartner is highlighting in 2026?

Agentic AI refers to AI systems that operate autonomously — perceiving their environment, making decisions, using tools like email, databases, and code execution, and completing multi-step tasks without a human approving each action. The security risk is structural: unlike a chatbot that generates text, an agentic system takes actions using real credentials with real consequences. When an attacker embeds malicious instructions in content the agent reads — a document, a web page, an API response — the agent may follow those instructions using its own authorized tools, bypassing standard access controls entirely. This attack class, ranked number one by the OWASP GenAI Security Project in 2026 under the name Agent Goal Hijacking, is what Gartner analysts are telling Tokyo attendees to prioritize in their governance roadmaps.

Why does agentic AI create a machine identity crisis?

Every AI agent authenticates to the systems it uses via machine credentials — API keys, tokens, OAuth grants, service accounts. Each new agent, and each sub-agent an agent spawns, generates new credentials that require lifecycle governance: creation, rotation, revocation, and auditing. Legacy identity and access management systems were designed for human users authenticating through browsers. They were not designed for software that mints hundreds of ephemeral credentials per week at runtime. A 2026 Cloud Security Alliance analysis found that more than 16% of organizations do not track the creation of AI-related identities at all. Gartner's Track D and Track F sessions in Tokyo are specifically designed to give CISOs a framework for rebuilding identity governance infrastructure around this new reality.

What is post-quantum cryptography and why does it matter for APAC enterprises right now?

Post-quantum cryptography (PQC) refers to encryption algorithms designed to resist attack by quantum computers — which, once they reach sufficient scale, will be able to break the RSA and elliptic-curve encryption systems most enterprise infrastructure currently relies on. Gartner's research predicts that will happen by 2030. The present-tense risk is what security researchers call "harvest now, decrypt later": adversaries are collecting encrypted enterprise data today, intending to decrypt it once quantum capability arrives. Organizations with sensitive data that must remain confidential for a decade or more — financial records, health data, intellectual property — face exposure now. Japan's NICT has already completed a hybrid PQC pilot in healthcare settings, and NIST finalized the first three post-quantum cryptographic standards in 2024, meaning the migration path exists. The gap is that most enterprises have not yet taken inventory of their cryptographic dependencies, which is the prerequisite to any migration.

What does the Gartner Magic Quadrant for SIEM mean for enterprise security buyers?

The Magic Quadrant for Security Information and Event Management is an annual Gartner research publication that evaluates SIEM vendors on two axes: ability to execute (current product capability, customer support, market presence) and completeness of vision (product roadmap, market understanding, innovation). SIEM platforms collect, normalize, and analyze security event data across networks, endpoints, and cloud environments to detect threats, support investigations, and satisfy compliance requirements. When Gartner presents an updated Magic Quadrant at the Tokyo summit, security leaders use it to benchmark their current vendor against the field, validate upcoming contract renewals or replacements, and identify which vendors have made the most progress toward AI-integrated threat detection and response. Magic Quadrant results from SRM summits typically drive vendor evaluation conversations for 12 months post-publication.