AI agents are the new shadow IT, and the M&A market is already circling

Every new wave of enterprise tech creates a new shadow IT problem. Cloud did it. SaaS did it. Now AI agents are doing it—except this time, the shadow has hands.

Judy Rider at Crunchbase News recently mapped the emerging M&A landscape for AI agent security, and the picture is familiar: a new class of enterprise identity, a fragmented market of control points, and acquirers starting to circle. But the real story isn't just who's buying what. It's that the pain is already here, and it's worse than most people think.

PainSignal tracks real-world problems from people using software, and the data shows AI agent security isn't a future concern—it's a present pain. We're seeing 347 problems mentioning AI agents or autonomous systems, with an average severity score of 3.9 out of 5. That's 23% higher than our platform average. When people complain about software problems, they complain loudly. But when they complain about AI agents, they complain urgently.

The biggest issue isn't identity. It's visibility. 42% of those problems mention a lack of visibility into agent actions. People don't know what their agents are doing, what they touched, or why they made a decision. That's not a theoretical risk. It's a daily operational headache.

Rider's piece rightly argues that this market won't develop as one broad "AI security" category. The real opportunity sits in specific control points: agent identity, data access, prompt security, MCP servers, traffic monitoring, auditability. Already, we're seeing deals like Kiteworks acquiring Bonfy.AI for data classification and Huskeys raising $27 million for securing agent traffic. Those are early signals of a market segmenting into distinct layers.

But our data adds a wrinkle the article misses. The market may split first between securing semi-autonomous copilots and fully autonomous agents. Most of the problems we track describe agents that are still heavily scripted or human-supervised, with limited decision-making. The risk profile for those is fundamentally different from fully autonomous agents that can move between systems, invoke tools, and make decisions without a human in the loop. Security needs will diverge accordingly.

For builders, this is a land grab. The pain points are concrete and growing. The fastest growing problem category in our data is "Compliance and audit for AI agents," up 210% quarter-over-quarter. That's not a blip. It's a scream. Enterprises are deploying agents faster than they can figure out who's liable when an agent sends the wrong email, or makes an unauthorized purchase, or leaks sensitive data.

That's where the M&A map gets interesting. Rider frames the opportunity around control points, and that's right. But the most valuable control point right now might be the audit trail. If you can give companies a clear, searchable log of what every agent did, when, and why—with compliance-ready reporting—you're not just solving a security problem. You're solving a liability problem. And liability problems get budgets.

Also missing from the article: the human factor. Our data shows employees are already misusing AI agents—deliberately or accidentally—to exfiltrate data, bypass controls, or perform malicious actions. Insider threats with agent amplification are a looming nightmare. Solutions that monitor both agent behavior and user behavior together will have a competitive edge.

For the indie hacker or vibe coder thinking about this space, the opportunity is tantalizing. You don't need to build a full security platform. You need to solve one specific pain, exceptionally well. Maybe it's a lightweight agent activity logger that plugs into common frameworks. Maybe it's a compliance dashboard that maps agent actions to SOC 2 controls. Maybe it's a simple anomaly detector that flags when an agent does something outside its normal pattern.

The acquirers are already looking. Kiteworks bought Bonfy.AI for data classification. Huskeys got $27 million to secure agent traffic. Larger identity providers, data security vendors, and cloud platforms will need agent security capabilities embedded in their products. They'll buy rather than build. That's your exit.

So don't think of this as "AI security." That's too broad. Think about exactly what you control. Is it the agent's identity? The data it can access? The actions it takes? The audit trail it leaves? Pick one. Own it. The M&A map is being drawn now, and it's drawn by the companies that solve the most painful, concrete problems first.

The shadow IT problem of the AI era isn't going away. It's just getting more autonomous—and more dangerous. That's not a future opportunity. It's a current emergency, and the companies that treat it that way will define the market.