Securing the next wave of agentic AI: why enterprise adoption needs governed infrastructure, not just models

Gartner expects up to 40 percent of enterprise applications to include task-specific AI agents by the end of 2026, up from under 5 percent in 2025. The same firm expects more than 40 percent of agentic AI projects to be canceled by the end of 2027. Both numbers can be true at once, and the reason they are both true has little to do with model quality. 

The gap shows up in the security data. Cloud Security Alliance research published in early 2026 found that 78 percent of organizations have no formally adopted policy for managing non-human identities, which is what an AI agent becomes the moment it holds a credential. Verizon’s 2026 Data Breach Investigations Report found that frequent use of unapproved AI tools tripled in a single year, reaching 45 percent of employees. Saviynt’s CISO AI Risk Report 2026 found that 75 percent of CISOs have already discovered unsanctioned AI tools running in production environments. 

Most enterprises are not failing at agentic AI because they picked the wrong model. They are failing because every team that wants an agent has to build the plumbing itself, and forty teams building forty versions of the same plumbing produces forty different security postures. 

The fragmentation problem starts quietly 

It rarely begins with a bad decision. A team needs an agent to query an internal service, so an engineer writes an integration. Another team needs something similar and writes their own, because finding and reusing the first one would take longer than starting over. Within two quarters, an organization has a dozen agent integrations, each with its own credential handling, its own idea of what data can leave which boundary, and its own logging, if it logs at all. 

The 2026 Infrastructure Identity Survey found that 70 percent of organizations grant AI systems more access than they would give a human employee doing the same job, and only 44 percent have implemented any policy for managing AI agents, even though 92 percent say governing them is critical. That combination is what fragmentation looks like when it is measured. 

“Nobody sets out to build shadow infrastructure. They set out to ship something useful, and the paved road either does not exist yet or is slower than the shortcut.”  

An agent is an identity, and it should be treated like one 

Enterprise identity programs were designed around people. People are onboarded, reviewed, and eventually offboarded. Agents have none of that lifecycle by default. An agent credential created for a six-week experiment tends to outlive the experiment, the project, and sometimes the engineer who created it. 

The Netwrix 2026 Data and Identity Security Report found that organizations where AI significantly expanded the number of identities touching data reported a 43 percent breach rate over the prior year, against 11 percent for organizations where AI had not changed access patterns. The variable is not AI adoption. It is whether the identities AI created were governed. 

Treating agents as first-class identities changes what infrastructure has to provide. Every agent needs an accountable owner, a scoped set of permissions tied to the task rather than to whatever the calling user happens to have, credentials that expire, and a way to revoke access without hunting through repositories. None of that is exotic. It is ordinary identity hygiene applied to a population that grows faster than the human one. 

“If you cannot answer who owns this agent and what it is allowed to reach, you do not have an AI program. You have an untracked service account with a language model attached.”  

Data handling belongs in the platform, not in each team’s judgment 

The hardest problems in enterprise agent deployment are usually data problems. Which systems can an agent read from, what leaves a controlled environment, what gets logged, what gets retained, and how any of that is proven to an auditor. 

When each team answers those questions independently, the organization inherits the weakest answer. Sensitive records reach a context window that nobody scoped for them. A prompt containingregulated data crosses a boundary it should not have crossed. Nobody is negligent. The controls simply lived in code review rather than in the runtime. 

Putting those controls into shared infrastructure inverts the default. Data classification, redaction, and boundary enforcement become properties of the path an agent must use, not commitments each team has to remember. For regulated industries, this is often what makes agent deployment possible at all, because it lets the compliance conversation happen once at the platform level instead of once per project. 

“Controls that depend on someone remembering to apply them are not controls. They are hoping for documentation.” 

Audit trails are what make autonomy defensible 

Autonomy raises the evidentiary bar. When a human takes an action, there is a person to ask. When an agent takes a series of actions across several systems at machine speed, the only account of what happened is whatever the infrastructure recorded. 

An audit trail worth having captures which agent acted, on whose behalf, against which resource, with what data, and under which policy decision. That record serves incident response first, but it also serves the slower work of building organizational trust. Executives approve broader agent autonomy when they can see a reconstructable history of what agents have been doing. Without that history, every expansion of scope is a leap of faith, and leaps of faith do not scale past the pilot. 

Standardization is an adoption strategy 

The objection to centralized agent infrastructure is that it slows teams down. In practice the opposite tends to hold once the platform exists. A team that can register an agent against a governed gateway, inherit authentication and data controls, and get logging without writing any of it will move faster than a team assembling those pieces itself. 

The strategic question for technology leaders is not whether to allow agents. That decision has usually already been made by employees who did not ask. The question is whether the organization offers a path that is both governed and genuinely faster than the alternative. If the governed path is slower, teams will route around it, and the governance will exist only on paper. 

Gartner’s 2026 CIO survey found that only 17 percent of organizations have deployed AI agents, while more than 60 percent expect to within two years. Most of that deployment has not happened yet. The organizations that build the connective layer first will spend the next two years shipping use cases. The ones that treat infrastructure as something to retrofit will spend it doing discovery on agents they did not know existed. 

“Governance and velocity are only in tension when the governed path is badly built. Build it well and it becomes the shortcut.”