Fifty-eight percent of organizations operate more than 50 AI agents today. Within 12 months, 66% expect to operate more than 50 agents, and 38% expect to operate more than 100. Thirty-six percent of leaders strongly agree that company leadership has directed the deployment of AI agents or agentic capabilities.

Seventy-five percent of leaders are concerned that an AI agent could perform the correct task in the wrong environment or location. Eighty-four percent believe agents can cross project boundaries more easily than employees, and 80% are concerned that agents may hold access that was never explicitly granted. A technically correct action can still be unauthorized because of where it happens and what it reaches.

Eighty-five percent say project-level isolation is essential or very essential for AI adoption. Asked which controls they want before expanding agent fleets, leaders rank explicit authorization first at 56%, with project isolation at 51% and session logging at 48%. Eighty-seven percent agree that authorization is the missing layer in agentic AI security.

Forty-three percent of leaders are very confident they can demonstrate what AI agents were explicitly authorized to do. Thirty-eight percent are very confident they can prove what an agent did through audit records. Thirty-seven percent monitor agent activity very closely. For each form of oversight the survey measured, most leaders stop short of the highest confidence tier.

Seventy-nine percent of leaders expect their organization will need to claw back or significantly restrict AI agent usage within the next 18 months. Gartner independently predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps that are only identified after production incidents occur.

Read the report