iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Organizations are experimenting with AI agents faster than many have built the controls to identify, authorize, monitor, and retire them. But “adoption” covers very different things: a supervised pilot is not the same as a production system that acts autonomously. Survey findings point to gaps in visibility, permissions, accountability, and incident response—not to one universal measure of harm or a proven industry-wide readiness ratio.
Why adoption statistics do not all mean the same thing
An AI agent can mean a feature that assists a person, a supervised workflow that calls tools, or a system that pursues a goal with little or no human oversight. Surveys that count any of these as “agents” cannot be treated as measuring the same level of deployment or autonomy.
Gartner surveyed 360 IT application leaders at organizations with at least 250 employees in North America, Europe, and Asia/Pacific in May and June 2025. Seventy-five percent said their organization was piloting, deploying, or had deployed some form of AI agents. By contrast, 15% said they were considering, piloting, or deploying fully autonomous agents—defined in Gartner’s release as goal-driven tools that do not require human oversight. These are different measures, and neither percentage is an audited count of production systems.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →In the same survey, 74% viewed agents as a new attack vector, while 13% strongly agreed their organization had suitable governance structures. Only 19% reported high or complete trust in vendors’ hallucination protection. These figures describe respondents’ perceptions, not technical tests of vendor safeguards. Gartner analyst Max Goss said concerns around governance, maturity, and agent sprawl were hampering deployment of “truly agentic AI.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What reported security gaps look like
When an agent can read enterprise data or take actions through connected tools, its risk depends on what it can access, what it is allowed to do, and whether its actions can be tied to an accountable identity. A broad permission or poorly managed credential can turn an ordinary workflow into an exposure path. Unknown agents add a visibility problem: security teams may not know which systems are acting, who approved them, or how to revoke access.
The following results come from separate Cloud Security Alliance (CSA) online surveys commissioned by security vendors. Their samples, field dates, and questions differ. The results are respondent reports, not independently verified incident records or a pooled industry estimate.
| Survey and sample | Reported finding |
|---|---|
| CSA survey commissioned by Zenity; 445 IT and security professionals across organizations of different sizes and locations; conducted September and November 2025; released April 16, 2026 | 53% said agents had exceeded intended permissions; 47% reported an agent-related security incident in the previous year; 58% said detection and response took five hours or longer. Only 16% had high confidence in detecting agent-specific threats, while 44% reported low or no confidence. |
| CSA survey commissioned by Token Security; 418 IT/security respondents; conducted online in January 2026; released April 21, 2026 | 82% reported unknown AI agents in their IT environments; 65% reported an agent-related incident in the prior 12 months; 21% said they had a formal agent decommissioning process. |
| CSA survey commissioned by Strata Identity; 285 IT/security respondents; conducted September and October 2025 | 21% maintained a real-time agent registry; 28% could reliably trace agent actions to a human or system across all environments. |
The Zenity-commissioned survey also found that 43% of respondents said more than half of employees regularly used AI agents. Fifty-four percent reported between 1 and 100 unsanctioned agents, and only 15% said that 76–100% of their agents had defined ownership. Just 5% used a single agentic platform; 44% reported using two or three, and 43% four or more. These are respondents’ estimates and reports, not an independent inventory of employees or agents.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The Strata Identity-commissioned survey found that 44% of respondents used or planned to use static API keys and 43% used or planned to use username/password combinations. These identity patterns can make it harder to distinguish an agent’s actions from a person’s or system’s, especially if credentials are shared or persist after a project ends.
CSA’s 2025 State of AI Security and Governance resource, commissioned by Google, also identifies governance maturity, workforce skills gaps, and data exposure as enterprise readiness themes. Its available summary provides no specific figures to support a quantitative comparison. A separate 2026 NeuralTrust report summary says 72% of surveyed organizations had deployed or were scaling agents and 29% had comprehensive controls; its incident finding uses a sample of 164 respondents. Those results come from a separate vendor-produced report and should not be combined with Gartner’s or CSA’s percentages.
Why agent integration creates control work
Integrating an agent is not just connecting a model to an application. It means deciding how the agent is discovered, who is accountable for it, what identity it uses, which data and tools it can reach, and how its actions are monitored. The reported gaps matter because an agent can act through existing enterprise services while remaining difficult to inventory or attribute.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Discovery: Unapproved or overlooked agents can operate outside a team’s expected inventory.
- Ownership: Without a named owner and approver, it is unclear who validates the agent’s purpose, access, and continued use.
- Permissions: Access broader than the task requires can allow unintended actions or expose more data than necessary.
- Identity and credentials: Shared, static, or human-style credentials can obscure which agent acted and complicate revocation.
- Traceability: If logs do not connect an action to an agent and a responsible person or system, investigation and accountability become harder.
- Response and retirement: Teams need a way to detect unusual behavior, contain it, and remove credentials and access when an agent is no longer needed.
The evidence supports treating these as operational control questions. It does not establish that every organization has the same maturity gap, or that agents caused a particular share of enterprise losses.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to review an organization’s agent readiness
A useful review follows an agent through its lifecycle, from discovery to decommissioning. The goal is to establish whether controls exist and work for the organization’s actual environments—not simply whether a policy document or platform is in place.
1. Discover and inventory agents
- Can teams find agents across SaaS applications, cloud environments, endpoints, and internal workflows, including unsanctioned use?
- Does the inventory identify each agent’s purpose, environment, connected tools, data access, and current status?
- Can owners reconcile the inventory with the platforms and accounts where agents actually run?
2. Assign ownership and approval
- Is there a named business or technical owner responsible for each agent?
- Is an approver responsible for validating the use case, data access, and permissions before deployment?
- Do teams know who must reassess an agent when its task, integrations, or operating environment changes?
3. Limit access and authorize actions at runtime
- Can each agent reach only the data and tools needed for its intended task?
- Are higher-impact actions restricted or subject to human approval where appropriate?
- Can access be narrowed or suspended quickly if the agent behaves unexpectedly?
4. Manage identity and credentials
- Does each agent have an identity that can be distinguished from a person’s account or a shared service credential?
- Are credentials scoped, protected, and rotated under a defined process?
- Can the organization revoke credentials without disrupting unrelated workflows?
5. Make actions attributable
- Do logs record what the agent did, which tools or data it used, and when?
- Can investigators link each action to the agent identity and the responsible owner, person, or system?
- Are records available across the environments where agents operate, rather than only within one platform?
6. Prepare for detection and response
- Can security teams identify agent-specific behavior that deviates from the approved task or access pattern?
- Are there clear steps to stop an agent, revoke its access, preserve relevant logs, and assess affected data or systems?
- Can the organization measure how long it takes to detect and contain unwanted behavior?
7. Decommission deliberately
- When a project ends, is there a process to disable the agent, remove credentials, revoke permissions, and archive required records?
- Can owners identify dormant agents and confirm whether they should be retired or reapproved?
These questions map to the visibility, ownership, runtime control, identity, traceability, response, and retirement weaknesses reported in the CSA surveys. The surveys do not prescribe a single technical architecture or establish a legal compliance standard; organizations should adapt the review to their own systems and risk.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What the surveys can—and cannot—show
Taken together, the findings indicate concern about agent security and reported weaknesses in inventory, permissions, identity, traceability, and lifecycle management. They do not show a single causal estimate of harm, prove that reported incidents were independently verified, or establish one adoption-to-readiness ratio for all organizations.
Gartner surveyed IT application leaders at larger organizations across three regions, while CSA’s studies surveyed IT and security professionals and were commissioned by different vendors. Definitions of “agent,” question wording, respondent populations, and field dates vary. The findings are best read as signals about specific respondents’ reported conditions, not as directly comparable measurements of every organization.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
