2027 State of Agentic AI Security: Adoption Without Control
Agentic AI is becoming operational before organisations can govern it. New research with 300 enterprise decision-makers reveals five connected gaps in how organisations discover, govern, connect, trust and observe AI agents.
Agentic AI is already here. Control is still catching up.
Two in three organisations have deployed agentic AI or plan to within 12 months. And among those without a sanctioned deployment, every respondent believes it’s already being used informally somewhere in the business.
Yet fewer than one in five are very confident they know every agent in use, five in six don’t give every agent its own identity, and fewer than a quarter can automatically stop a rogue agent in real time.
The gap between adoption and control is widening. This report explores where organisations are most exposed, why those gaps matter, and how the five pillars of identity security can help them scale agentic AI with greater confidence.
Use the charts to explore the key findings and see where confidence is high, and where the biggest gaps remain.
How confident are you that you know all of the AI Agents that are operating in your organisation?
Which of the following statements best describes how AI agents are governed in your organisation?
Does your organisation operate an AI Gateway (or MCP Gateway) for all Agentic AI network traffic?
To what extent do AI Agents have authenticated unique identities?
To what extent are you able to observe Agentic AI activity as a whole across your organisation?
Agentic AI is already here. Control is still catching up.
Two in three organisations have deployed agentic AI or plan to within 12 months. And among those without a sanctioned deployment, every respondent believes it’s already being used informally somewhere in the business.
Yet fewer than one in five are very confident they know every agent in use, five in six don’t give every agent its own identity, and fewer than a quarter can automatically stop a rogue agent in real time.
The gap between adoption and control is widening. This report explores where organisations are most exposed, why those gaps matter, and how the five pillars of identity security can help them scale agentic AI with greater confidence.
I think this works better in the page you’ve shown because it gets the reader to the five readiness gaps quickly, rather than asking them to read five paragraphs before reaching the more visual content.
See how your sector compares
Segment snapshots set each sector's results against the overall sample of 300 organisations.
US market
snapshot
The US is building more control infrastructure, but maturity remains uneven.
Banking sector snapshot
Banking is further ahead on adoption and control, but least-privilege access still lags.
Higher education snapshot
Higher education is earlier in its journey and trails the wider market on core controls.
Retail and e-commerce snapshot
Retail shows strong appetite for Agentic AI, but control maturity remains uneven.
