Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Snyk’s 2026 report-linked figures point to two important findings in the AI environments it assessed: model counts alone miss many related components, and 28.4% of organizations in the assessed data ran agentic architectures in production. The figures come from anonymized telemetry across more than 500 Evo by Snyk AI discovery assessments of a subset of pre-approved customers—not a representative census of enterprises.
What Snyk’s figures measure—and who they describe
Snyk’s report examines enterprise AI adoption through AI-bill-of-materials (AI-BOM) telemetry. Its landing page describes more than 500 assessments of early adopters using Evo by Snyk; the data is anonymized and drawn from a subset of pre-approved customers. The available report-linked summary does not establish the complete collection period or methodology, so these figures should be read as vendor-reported observations from those assessed environments, not estimates of adoption across all businesses. Snyk’s report landing page
The headline claims—an AI footprint three times larger than model-only counts and agentic adoption at roughly one in four organizations—are rounded framings of the more specific figures below, not separate measurements.
Why model-only inventories miss AI components
In a report-linked summary, Snyk Chief Innovation Officer Manoj Nair reports an average of 0.24 models per repository and 0.68 total AI components per repository when tools, packages, datasets, and orchestration layers are included. In other words, the broader inventory is nearly three times the model count in the assessed data. These are averages per repository, not counts of distinct components across an organization. Nair’s report-linked summary
The practical implication is that a register containing model names alone may not describe the full software surface involved in AI-enabled development. Tools and supporting packages, data assets, and orchestration layers can also matter to security and governance. The figures demonstrate a difference in inventory scope; they do not establish that every additional component is vulnerable or creates equal risk.
How much agentic AI was in production?
Nair’s summary reports that 28.4% of organizations in Snyk’s assessed data ran agentic architectures in production, defining these as agents and/or MCP servers. Snyk’s landing page rounds this to roughly one in four organizations. The source material reviewed does not establish a confidence interval or a representative sampling method, so the percentage should not be generalized to all organizations.
This is a production-use measure, not a measure of how many agents each organization ran, how extensively they were deployed, or how safely they were governed. The report page identifies healthcare, financial services, and technology as industry benchmark areas, but the figures available here do not provide sector-specific rates or rankings.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Third-party tools and dataset tracking
Third-party packages
Snyk’s summary says 82.4% of AI tools came from third-party packages in the assessed data. That makes dependency visibility relevant to an AI inventory: organizations may need to account for tools brought in through packages, not just models selected directly by teams. The figure does not specify package counts, risk levels, or the proportion of all software dependencies that were AI-related.
Explicitly tracked datasets
The same summary reports 0.46 explicitly tracked datasets per model. This describes what was explicitly tracked in the assessed environments; it does not show that the remaining models had no datasets, nor does it establish how tracking was defined or whether datasets were cataloged elsewhere.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations can reasonably take from the report
- Compare an organization’s model list with a broader inventory that includes tools, packages, datasets, and orchestration components.
- Check whether production agents and MCP servers are visible to the teams responsible for security and governance.
- Review how third-party AI tools enter development environments and whether their dependencies are captured.
- Determine whether dataset relationships are explicitly documented, rather than assuming that an untracked dataset is unused.
Snyk’s Chief Innovation Officer Manoj Nair framed the governance challenge this way: “Agentic architectures turn governance into a software supply chain problem.” That is an executive’s interpretation of the findings, not a measured conclusion about every deployment. Snyk’s March 23, 2026 announcement
Quick Recap
What the available figures do not establish
- They do not establish prevalence among all enterprises, because the data covers anonymized assessments from a subset of pre-approved customers.
- They do not support sector comparisons: healthcare, financial services, and technology are named as benchmark categories, but sector values are not present in the available summary.
- They do not establish causation, risk severity, or whether particular inventory practices lead to safer outcomes.
- They do not provide enough methodological detail here to assess collection dates, confidence intervals, or how each category was classified.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
