在107家企业中，AI Agent正被赋予对系统和数据的真实访问权限，而本应约束它们的控制措施却严重滞后。超半数企业已发生经确认的Agent安全事件或险兆；仅约三分之一为每个Agent分配独立、范围化的身份，多数Agent仍共享凭据；且只有十分之三的企业隔离其最高风险Agent。安全工具栈压倒性地借用了模型供应商和超大规模云厂商的解决方案，而非为Agent专门构建；安全支出仅占整体安全预算的一小部分，企业对其防御措施能否跟上AI驱动的攻击者看法各半。结果就是Agent安全缺口——自主Agent的扩散速度远快于约束它们所需的身份、隔离和执行控制。

本轮VentureBeat Pulse调研探究企业如何保护其AI Agent：它们运行哪些工具，如何管理Agent身份与隔离，已发生过哪些问题，安全支出多少，以及是否认为自身防御能跟上AI驱动的攻击者。

核心发现是Agent安全缺口——即企业赋予Agent的自主权限与用于约束它们的控制措施之间的差距。超过一半的组织（54%）已遭遇确认的Agent安全事件（18%）或在造成危害前被拦截的险兆（36%）。这些数字背后的结构性弱点是身份管理：仅约三分之一（32%）为每个Agent分配独立、范围化的托管身份，其余反馈部分Agent共享凭据，或Agent主要在共享API密钥及人类或服务账户凭据上运行。当Agent共享凭据时，单个被攻破或权限过大的Agent将造成广泛的破坏范围——而仅十分之三的企业（30%）在沙箱中隔离其最高风险Agent以限制该范围。

这一缺口之所以引人注目，是因为企业身处其中却安之若素。安全工具栈压倒性地以供应商原生控制为主——OpenAI的护栏（51%）、谷歌和微软的云控制以及Anthropic的托管Agent控制占据主导，而专门的Agent安全供应商几乎无人问津——并且对这些借用工具的满意度很高，平均分4.2（满分5分）。然而，支出仍只占安全预算的一小部分，仅三分之一的企业认为其AI防御领先于AI驱动的攻击者，且绝大多数计划在年内更换工具。企业对自己正在准备替换的控制措施感到满意。

方法论

VentureBeat 将本项调查作为其持续进行的 Pulse Research 系列的一部分开展，本调查工具聚焦企业 Agent 安全——组织用于保护自主 AI Agent 的工具、身份、隔离与执行控制。回复筛选自员工超过 100 人的组织（n=107；排除了调查中最小的 1-100 人规模区间），取自 2026 年 6 月单一波次。由于是单次调查而非跨月汇总样本，本报告为横截面解读，不推断月度趋势。部分问题为多选，因此各项占比之和可能超过 100%。

按角色划分，样本层次高且具有采购可信度：45% 是 AI 采购的最终决策者，另有 30% 为推荐人或影响者。管理层（43%）、个人贡献者（24%）、副总裁与总监（15%）及最高管理层（11%）构成了职级组合。按组织规模，样本偏向中型市场：251-1,000 人（42%）和 101-250 人（25%）的企业居首，之上为 1,001-5,000 人（19%）、5,001-10,000 人（8%）及 10,001+ 人（7%）。技术/软件是最大行业，占比 23%，随后是制造业（15%）、零售/电商（14%）和医疗/生命科学（13%）。

样本量 107 份回复，足以观察方向性趋势，但应视为方向性信号而非精确计量；样本为自荐参与，并非概率样本。样本偏重中型市场，因此最好解读为来自正在积极构建 Agent 安全的组织的观点，而非来自最大规模运营方。

满意度评分根据回答每项评分问题的受访者计算；整体满意度得分反映 107 名合格受访者中的 82 人。

发现1：安全事件已经发生

超半数企业已发生Agent安全事件或险兆

我们询问组织是否经历过Agent安全事件——确认的入侵，或在造成危害前被拦截的险兆。大多数在生产环境中运行Agent的企业都有过。

发现1 — 安全事件已经发生

42% 未发现此类事件

36% 是——在造成危害前被拦截的险兆

18% 是——已确认的事件

5% 不适用——无生产环境Agent；2%未跟踪此类事件

这是本报告的定义性数字。超过一半的组织（54%）已经历过Agent安全事件——18%为确认事件，36%为在造成危害前被拦截的险兆。仅42%报告未发现任何事件，其余少数要么未在生产环境运行Agent，要么不追踪此类事件。如此多企业报告险兆而非仅确认事件，这一点很能说明问题：企业正在拦截问题，但往往在红线边缘才拦截到。本报告其余部分审视的控制措施——身份、隔离、执行——决定了下一个险兆会否成为真正的安全事件。

曝险程度随公司规模扩大而上升，但隔离措施并未同步跟进。中型市场（101-1,000人企业）的事件或险兆发生率为49%，大型企业（员工超过1,000人）则升至63%；而高风险Agent的沙箱隔离率从35%降至20%，对安全工具的满意度从4.36降至3.97。在更多系统、更多Agent的组织中，安全事件最多，而唯一能限制事件破坏范围的隔离控制却最少。

发现2：身份管理缺口

仅三分之一为每个Agent提供独立、范围化的身份

我们询问企业如何管理其AI Agent的身份——是否每个Agent拥有自己的凭据，还是共享凭据。完全按Agent分配身份的是少数。

发现2 — 身份管理缺口

48% 部分Agent拥有范围化身份，但许多仍共享凭据

32% 每个Agent都拥有独立的、范围化的托管身份

32% Agent主要在共享API密钥或人类/服务账户凭据上运行

7% 不适用——无生产环境Agent；5%不知道

综合来看，重叠的回答显示69%的企业（107家中的74家）在Agent体系中存在凭据共享现象。身份管理是事件背后的结构性弱点。仅约三分之一的企业（32%）为每个Agent分配独立、范围化的托管身份——这是最小权限访问和清晰归属的先决条件。近半数（48%）表示部分Agent拥有范围化身份，但许多仍共享凭据，另有32%称Agent主要在共享API密钥或借用的人类与服务账户凭据上运行。（受访者可描述其Agent体系中的多种模式，因此这些比例存在重叠。）

后果非常直接：当Agent共享凭据时，权限过大或受攻击的Agent可以超出预期范围进行操作，事后取证无法清晰地分辨哪个Agent做了什么。非人身份问题——为每个Agent赋予受管控的身份——是企业Agent安全中尚未完成的最大单块拼图。

此外，企业的Agent凭据状况与事件发生率相关。存在凭据共享的组织在过去十二个月内遭遇事件或险兆的比例为63.5%（74家中的47家）。每个Agent都拥有独立范围化身份的组织，该比例为40.9%（22家中的9家）。完全范围化身份的群体规模较小，因此目前此关系为关联而非证明的因果关系，且差距集中在中型市场——但在同一项调查中，事件率相差二十三个百分点，颇具显著性。

发现3：观察与执行常见，隔离却很少

仅十分之三的企业对其最高风险Agent进行沙箱隔离

我们询问组织的Agent安全态势在实践中是什么样子——是观察、执行、隔离，还是某种组合。限制损害的控制使用得最少。

发现3 — 观察与执行常见，隔离却很少

49% 执行——Agent拥有范围化身份和权限，并在运行时执行

47% 观察——监控并记录Agent活动，但运行时执行有限

30% 隔离——高风险Agent在沙箱中运行，若控制失效则破坏范围受限

6% 不知道；5% 尚无专门的Agent安全计划

监控与执行相对常见，但隔离却非如此。约半数企业观察Agent活动（47%）或在运行时执行范围化权限（49%），但仅30%将其最高风险Agent隔离在沙箱中，以便在其他控制措施失效时限制破坏范围。从纵深防御的角度看，此顺序完全颠倒：观察让你知道发生了什么，执行试图阻止，但隔离才是在预防失效时限制损害的手段——而这正是企业采用最少的控制。结合发现2中的身份缺口，呈现出Agent被监视、被授予权限却极少被框定的画面，而这恰恰是一次失败就导致蔓延的配置。

发现4：安全依赖借用的供应商原生控制

OpenAI、谷歌和微软的护栏占主导；专业厂商几乎无人问津

我们询问企业使用哪些Agent安全工具，以及哪一个是其主要层级。答案偏向模型供应商和超大规模云厂商，而非专门的安全厂商。

发现4 — 安全依赖借用的供应商原生控制

51% 使用OpenAI内置护栏；36% 谷歌云控制；35% 微软Azure（Purview/Copilot Studio DLP）；29% Anthropic托管Agent控制

13% 微软 Entra Agent ID；10% AWS Bedrock 护栏

8% 分别使用开源护栏、Cloudflare 和 Cisco；专业厂商（Palo Alto、CrowdStrike、Zenity、HiddenLayer、Lakera、Okta）处于低个位数

82% 将供应商原生或超大规模云厂商的控制列为其主要Agent安全层

企业正使用随模型和云平台捆绑提供的工具来保护Agent。OpenAI的护栏以51%领先，其次是谷歌和微软的云原生控制以及Anthropic的托管Agent控制——当被问及单一主要安全层时，82%的受访者提到了这些供应商原生产品。专门为Agent构建的安全类别——Palo Alto的Prisma AIRS、CrowdStrike、Cisco AI Defense、Zenity、HiddenLayer、Check Point的Lakera、Okta for AI Agents、非人身份平台——几乎无人采用，每项均在低个位数，仅5%未运行任何专用工具。与本研究系列中的检索和评估情况一样，供应商捆绑包正在赢得默认地位：企业最先使用的是其平台附带的护栏，而能够解决身份与隔离缺口的独立安全层尚未被大规模采用。

供应商默认为主这一模式在两个Q2调查波次中保持一致。在4月至5月（n=110）的调查中，使用率同样由这些名字主导——OpenAI的控制占26%，Azure占15%，AWS占14%，Google占12%——而每个专门的Agent安全厂商占比在3%以下，一成企业完全未使用任何专用工具。两项调查的共同发现是：企业默认使用其所用平台提供的解决方案，专业类别厂商尚未在此成为重要角色。

(关于解读这些比例的说明。如方法论部分所述，受访者样本为自荐参与且偏重中型市场，该使用问题统计了每位受访者部署的每个供应商或方法——因此数字衡量的是在安全栈中的存在感，而非支出或排他性。个别供应商百分比因此带有通常的样本局限性。然而，这一结构性模式在两次Q2波次的不同措辞问题中均成立：供应商原生与超大规模云厂商的控制占据主导，专门的Agent安全厂商仍处于低个位数。宽泛看待个别占比，但对模式应抱有信心。)

发现5：企业对此感到心安

满意度很高，即使事件增多且身份管理滞后

我们询问企业对当前Agent安全工具的满意度。这种舒适感与上文记录的曝险情况明显脱节。

发现5 — 企业对此感到心安

4.2 当前Agent安全工具的总体满意度平均分，满分5

4.1 性价比平均分；实施简便性稍低，为3.9

54% 尽管如此，仍有54%已发生确认事件或险兆（发现1）

32% 仅32%为每个Agent提供独立范围化身份（发现2）

对Agent安全工具的满意度很高——总体4.2（满分5），性价比4.1——属于本系列中最积极的读数之一。令人震惊之处在于：企业对一个主要由借用供应商护栏组成的工具栈高度满意，尽管超半数已发生事件或险兆，仅三分之一为Agent分配范围化身份。这种安心似乎建立在供应商原生控制的便捷性和低摩擦上，而非经过验证的隔离能力。这正在形成一种虚假的安全感——正如发现8所示，这些表示满意的企业绝大多数计划在年内更换工具，表明其信心比评分所暗示的更为脆弱。

发现6：预算已有

Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents still share credentials; and only three in ten isolate their highest-risk agents. The security stack is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents, spending remains a thin slice of the security budget, and enterprises are evenly split on whether their defenses are keeping pace with AI-enabled attackers. The result is an agent security gap — autonomous agents proliferating faster than the identity, isolation, and enforcement controls needed to hold them.

This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers.

The central finding is an agent security gap — the distance between the autonomy enterprises are granting their agents and the controls in place to contain them. More than half of organizations (54%) have already experienced a confirmed agent security incident (18%) or a near-miss caught before harm (36%). The structural weakness beneath those numbers is identity: only about a third (32%) give every agent its own scoped, managed identity, while the rest report that some agents share credentials or that agents mostly run on shared API keys and human or service-account credentials. When agents share credentials, a single compromised or over-permissioned agent carries a wide blast radius — and only three in ten enterprises (30%) isolate their highest-risk agents in sandboxes to bound that radius.

What makes the gap notable is how comfortable enterprises are inside it. The security stack is overwhelmingly provider-native — OpenAI’s guardrails (51%), Google’s and Microsoft’s cloud controls, and Anthropic’s managed-agent controls dominate, while the dedicated agent-security specialists barely register — and satisfaction with that borrowed stack is high, averaging 4.2 out of 5. Yet spending remains a thin slice of the security budget, only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to change tooling within the year. Enterprises are satisfied with controls they are simultaneously preparing to replace.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.

By role the sample is senior and buyer-credible: 45% are final decision-makers for AI purchases and another 30% recommenders or influencers. Managers (43%), individual contributors (24%), VPs and directors (15%), and the C-suite (11%) make up the seniority mix. By organization size the sample is mid-market-weighted: 251–1,000 (42%) and 101–250 (25%) employees lead, with 1,001–5,000 (19%), 5,001–10,000 (8%), and 10,001+ (7%) above them. Technology/Software is the largest industry at 23%, followed by Manufacturing (15%), Retail/E-commerce (14%), and Healthcare/Life Sciences (13%).

At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent security rather than from the largest operators.

Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents.

Finding 1: The incidents are already here

More than half have had an agent security incident or near-miss

We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had.

Finding 1 — The incidents are already here

42%

no such incident identified

36%

yes — a near-miss caught before harm

18%

yes — a confirmed incident

5%

not applicable — no agents in production; 2% don’t track this

This is the report’s defining number. More than half of organizations (54%) have already had an agent security event — 18% a confirmed incident and 36% a near-miss caught before it caused harm. Only 42% report nothing, and a small remainder either run no agents in production or don’t track such events. That so many report near-misses rather than only confirmed incidents is telling: enterprises are catching problems, but they are catching them close to the edge. The controls examined in the rest of this report — identity, isolation, enforcement — are what determine whether the next near-miss stays a near-miss.

Exposure scales with company size, but containment does not. The incident-or-near-miss rate rises from 49% in the mid-market (companies with 101-1,000 employees) to 63% at larger enterprises (above 1,000 employees), while sandbox isolation of high-risk agents falls from 35% to 20%, and satisfaction with security tooling drops from 4.36 to 3.97. The organizations running the most agents across the most systems carry the most incidents and the least of the one control that bounds an incident's blast radius.

Finding 2: The identity gap

Only a third give every agent its own scoped identity

We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception.

Finding 2 — The identity gap

48%

some agents have scoped identities, but many still share credentials

32%

each agent has its own scoped, managed identity

32%

agents mostly run on shared API keys or human / service-account credentials

7%

not applicable — no agents in production; 5% don’t know

Rolled together, the overlapping answers show 69% of enterprises (74 of 107) with credential sharing somewhere in the agent fleet. Identity is the structural weakness beneath the incidents. Only about a third of enterprises (32%) give every agent its own scoped, managed identity — the precondition for least-privilege access and clean attribution. Nearly half (48%) say some agents have scoped identities but many still share credentials, and another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. (Respondents could describe more than one pattern across their agent fleet, so these overlap.)

The consequence is direct: when agents share credentials, an over-permissioned or compromised agent can act with far more reach than intended, and forensics after an incident cannot cleanly tell which agent did what. The non-human identity problem — giving every agent its own governed identity — is the single largest unfinished piece of enterprise agent security.

Moreover, a company’s agent credential posture is correlated with incidents. Organizations with credential sharing anywhere in the fleet were hit — with an incident or a near-miss in the past twelve months — at 63.5% (47 of 74). Organizations where every agent carries its own scoped identity were hit at 40.9% (9 of 22). The fully-scoped group is small, so for now the relationship is an association rather than proven causation, and the gap is concentrated in the mid-market — but within a single survey, a twenty-three point difference in incident rate suggests significance.

Finding 3: Observe and enforce, but rarely isolate

Only three in 10 sandbox their highest-risk agents

We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common.

Finding 3 — Observe and enforce, but rarely isolate

49%

enforce — agents have scoped identities and permissions, enforced at runtime

47%

observe — they monitor and log agent activity, but runtime enforcement is limited

30%

isolate — high-risk agents run sandboxed, with bounded blast radius if controls fail

6%

don’t know; 5% have no dedicated agent security program yet

Monitoring and enforcement are reasonably common; containment is not. Roughly half of enterprises observe agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% isolate their highest-risk agents in sandboxes that bound the blast radius when the other controls fail. That ordering is backwards from a defense-in-depth standpoint: observation tells you what happened, enforcement tries to prevent it, but isolation is what limits the damage when prevention fails — and it is the control enterprises have adopted least. Combined with the identity gap in Finding 2, the picture is of agents that are watched and permissioned but rarely boxed in, which is precisely the configuration in which a single failure propagates.

Finding 4: Security runs on borrowed, provider-native controls

Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register

We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors.

Finding 4 — Security runs on borrowed, provider-native controls

51%

use OpenAI’s built-in guardrails; 36% Google Cloud controls; 35% Microsoft Azure (Purview / Copilot Studio DLP); 29% Anthropic’s managed-agent controls

13%

Microsoft Entra Agent ID; 10% AWS Bedrock Guardrails

8%

each uses open-source guardrails, Cloudflare, and Cisco; the dedicated specialists (Palo Alto, CrowdStrike, Zenity, HiddenLayer, Lakera, Okta) sit in low single digits

82%

name a provider-native or hyperscaler control as their primary agent security layer

Enterprises are securing agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 51%, followed by Google’s and Microsoft’s cloud-native controls and Anthropic’s managed-agent controls — and when asked to name their single primary security layer, 82% name one of these provider-native offerings. The purpose-built agent-security category — Palo Alto’s Prisma AIRS, CrowdStrike, Cisco AI Defense, Zenity, HiddenLayer, Check Point’s Lakera, Okta for AI Agents, non-human identity platforms — barely registers, each in the low single digits, and only 5% run no dedicated tooling at all. As with retrieval and evaluation elsewhere in this series, the provider bundle is winning the default: enterprises reach first for the guardrails their platform ships, and the independent security layer that would address the identity and isolation gaps has not yet been adopted at scale.

The provider-default pattern is consistent across both Q2 survey waves. In April–May (n=110), usage was led by the same names — OpenAI's controls at 26%, Azure at 15%, AWS at 14%, Google at 12% — with every dedicated agent-security specialist at 3% or below and one in ten using no dedicated tooling at all. The common finding from the two surveys: Enterprises are defaulting to the solutions provided by the platform they’re using, and the specialist category vendors have yet to become big players here.

(A note on reading these shares. As described in the methodology section, the respondent sample is self-selected and skews mid-market, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern, however, held across both Q2 waves on two differently worded questions: provider-native and hyperscaler controls lead, and dedicated agent-security specialists remain in low single digits. Read the individual shares loosely and the pattern with confidence.)

Finding 5: And enterprises are comfortable with it

Satisfaction is high, even as incidents mount and identity lags

We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above.

Finding 5 — And enterprises are comfortable with it

4.2

average overall satisfaction with current agent security tooling, on a five-point scale

4.1

average value for money; ease of implementation trails slightly at 3.9

54%

have nonetheless already had a confirmed incident or near-miss (Finding 1)

32%

give every agent its own scoped identity (Finding 2)

Satisfaction with agent security tooling is high — 4.2 out of 5 overall, and 4.1 for value for money — among the most positive readings in this series. That is the striking part: enterprises are highly satisfied with a stack that is mostly borrowed provider guardrails, even though more than half have already had an incident or near-miss and only a third give their agents scoped identities. The comfort appears to rest on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is a false comfort in the making — the same enterprises expressing satisfaction are, as Finding 8 shows, a clear majority planning to change tooling within the year, which suggests the confidence is thinner than the score implies.

Finding 6: Budgets haven’t caught up

Most spend under a tenth of the security budget on agents

We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest.

Finding 6 — Budgets haven't caught up

46%

allocate 6–10% of their security budget to agent / AI security — the most common band

26%

allocate 1–5%; a further 8% under 1%

9%

allocate more than 25%

Spending on agent security is still a thin slice. The most common allocation is 6–10% of the security budget (46%), and a third of enterprises (34%) spend 5% or less; only a quarter (24%) devote more than a tenth. Given the incident rate in Finding 1 and the identity and isolation gaps in Findings 2 and 3, the budget looks like a lagging indicator — the risk has arrived faster than the funding to address it. The enterprises spending more than a tenth of their security budget on agents are a distinct minority, and they are likely the ones building the scoped-identity and isolation controls the rest have not.

Finding 7: The arms race is even, at best

Only a third think their AI defenses are ahead of AI-enabled attackers

We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled.

Finding 7 — The arms race is even, at best

35%

our AI-enabled defenses are ahead

21%

attackers using AI are ahead of our defenses

21%

too early to tell; 6% don’t know

Enterprises are split on whether they are winning. Only about a third (35%) believe their AI-enabled defenses are ahead of AI-enabled attackers; the rest are less sure — 32% call it roughly even, 21% think attackers are ahead, and another 21% say it is too early to tell. Taken together, a clear majority (53%) rate the balance as even or tilted toward the attacker. That uncertainty sits uneasily beside the high satisfaction of Finding 5: enterprises are content with their tooling yet unconvinced it is winning the contest it exists to win. In a domain where the offense is also compounding with AI, an even race is not a comfortable place to be.

Finding 8: A security reshuffle is coming

Nearly six in 10 plan to adopt or switch tooling within a year

We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat.

Finding 8 — A security reshuffle is coming

41%

have no plans to change

29%

plan to adopt or switch within the next 0–3 months

The security stack is not settled. While 41% have no plans to change, a clear majority (59%) intend to adopt a new, additional, or replacement agent security solution within twelve months, and 29% within the next quarter — a strong signal that, high satisfaction notwithstanding, enterprises know the current stack is provisional. Incidents are what start the buying cycle.

Among organizations that have been hit, 42.1% plan to adopt, add, or replace agent security tooling within the next ninety days, against 14.0% of organizations with no incident — and after a confirmed incident it becomes majority behavior, at 52.6%. Getting hit also changes the threat assessment: 33.3% of hit organizations say AI-armed attackers are ahead of their defenses, against 8.0% of the unhit. Experience, in this data, is the strongest predictor of both urgency and pessimism.

The consideration set still leans provider-native (OpenAI 34%, Google 30%, Anthropic 29%, Azure 25%), but the dedicated security vendors — Cloudflare, Cisco, Palo Alto, Okta, Check Point’s Lakera — draw early interest in the mid-to-high single digits, more than their current footprint.

What the shopping does not yet include is the identity layer specifically. Twelve percent of the respondents include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set, and among the credential-sharing organizations that have already had an incident, identity consideration is essentially unchanged, at roughly one in ten. The control most directly implicated by the incident data is the one largely missing from the purchase plans. Whether this wave hardens the provider-native default or finally opens the door to purpose-built agent security — the identity and isolation controls the incidents call for — is the question this series will keep tracking.

The bottom line: A security gap that autonomy will test first

Organizations with more than 100 employees are giving AI agents real reach into systems and data while securing them with controls built for something else. More than half have already had an incident or near-miss; only a third give every agent its own scoped identity, and most still share credentials; only three in ten isolate their highest-risk agents; and the stack doing this work is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents.

The uncomfortable pairing is confidence with exposure: satisfaction with the current tooling is among the highest in this series, yet spending is a thin slice of the security budget, only a third believe their defenses are ahead of AI-enabled attackers, and a clear majority are already planning to replace what they have. At 107 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: agent adoption is running ahead of agent security, and the controls that matter most when something fails — scoped identity and isolation — are the ones enterprises have built least. The agent security gap is not a coverage problem that a provider guardrail will close on its own; it is a problem of identity, isolation, and enforcement built for autonomous software. The open question for later waves is whether enterprises close it deliberately — or whether a confirmed incident closes it for them.

---

Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read, not a precise measurement — the sample is self-selected and skews mid-market, so it's best read as the view from organizations actively standing up agent security rather than from the largest operators. Respondents are senior and buyer-credible (45% final decision-makers, 30% recommenders/influencers), spanning managers through the C-suite, and drawn primarily from Technology/Software, Manufacturing, Retail/E-commerce, and Healthcare/Life Sciences.