35% of Organizations Run Over 1000 AI Agents
A recently released report by ServiceNow analyzed the effect of agentic AI exposure. According to the report, nine in 10 global organizations have already experienced an agentic AI security incident in the past year, and 36% of those businesses contained it in under 24 hours.
According to the report, while many security leaders self-assess as having established agentic security postures, 13% have defensible programs when measured against five key domains: attack surface, accountability, security by design, visibility, and audit readiness.
Most agentic AI is currently governed by legacy frameworks and human-driven systems, with less than half of organizations using governance frameworks that cover key elements of AI agent deployments. Just 44% of security teams globally design security into an agent’s development before it’s built, which means for the majority, permissions and guardrails are being implemented on an ad-hoc, after-the-fact basis.
- Scale and blind spots compound organizations' exposure
- 49% of organizations now run between 100 and 999 AI agents, and 35% run more than 1,000.
- 57% of security teams have a full, accurate record of every AI agent in production and have processes to track changes.
- 29% of security teams found AI agents running in production that had never been registered or known. What gets missed can surface later as shadow AI, discovered only after it's already been running unsupervised.
- Machine-speed risk is outpacing human-speed response
- 76% of organizations say they maintain a complete, current map of every agent's access, but 19% can see more than 90% of their agents in real time.
- Even organizations that can see a problem often can't stop it fast enough. Two-thirds (66%) cannot act automatically when an agent behaves anomalously, which means a human still has to intervene before anything changes.
Looking for a reprint of this article?
From high-res PDFs to custom plaques, order your copy today!
