Feb 2026
Gravitee State of AI Agent Security report: only 14.4% of organizations have full security approval for their agent fleet
AI
Enterprise AI Agents Are Outpacing the Governance Frameworks Built to Control Them
Agents gain authority → Security frameworks scramble to catch up
Level 1
Agents Outrun the Rules
Enterprise AI agents are being deployed at a pace that far exceeds the governance, security, and identity frameworks designed to manage them. Only 10% of organizations have a clear strategy to govern AI agents, even as 79-91% already use them. Security leaders at RSAC 2026 converged on the same warning: the gap between deployment velocity and governance readiness is now a live enterprise liability.
Bullets
- 91% of organizations use AI agents, but only 10% have a governance strategy
- Only 14.4% of organizations report full security approval for their entire agent fleet
- Anthropic and Nvidia shipped the first two public zero-trust agent architectures
- Spec-driven development is emerging as the trust anchor for autonomous coding agents
Key Points
- The governance gap between agent deployment and security readiness is measurable and widening
- Real-world breaches tied to ungoverned agents have already occurred
- Two competing architectural responses have shipped, but neither fully solves the problem
Timeline
Mar 2026
Nvidia releases NemoClaw in early preview, a stacked-layer zero-trust agent architecture
Apr 2026
Anthropic launches Managed Agents in public beta, separating agent brain, execution, and credentials
Apr 2026
RSAC 2026: Four major vendors independently identify AI agent governance as the top enterprise security gap
Apr 2026
Fortune analysis confirms 91% of organizations use AI agents but only 10% have a clear management strategy
Sources
VentureBeat
2 weeks ago
Fortune
2 weeks ago
VentureBeat
2 weeks ago
VentureBeat
2 weeks ago
Level 2
The Authority Gap Is the Risk
The core problem is not that AI agents are unintelligent or unreliable. It is that enterprises are delegating operational authority to non-human actors inside security and identity frameworks built exclusively for humans. Agents do not log in or out, they operate across systems continuously, and most organizations cannot distinguish agent activity from human activity in their own logs. The governance deficit is not a future risk to plan for, it is the present condition under which most enterprises are already running.
Key Points
- 68% of organizations cannot distinguish agent activity from human activity in their logs, making incident attribution structurally impossible
- The identity gap is a leadership problem, not only a technical one: agents need lifecycle management, scoped permissions, and offboarding just as employees do
- Spec-driven development is emerging as the primary trust mechanism for autonomous coding, making the specification the enforceable contract between human intent and agent action
- Two zero-trust agent architectures have shipped publicly, creating the first auditable baseline for enterprise security directors to evaluate vendors against
- Real-world incidents including a McDonald's chatbot breach and a Replit agent deleting a production database confirm the governance gap has already caused material damage
Sources
VentureBeat
2 weeks ago
Fortune
2 weeks ago
VentureBeat
2 weeks ago
VentureBeat
2 weeks ago
Level 3
Who Wins, Who Gets Burned
The governance gap is not uniform across the enterprise. Organizations that invest early in agent identity management, spec-driven development, and zero-trust architectures will convert AI deployment into durable competitive advantage. Those that continue treating agents as background software will accumulate invisible liabilities that surface as compliance failures, security breaches, and audit exposure. The regulatory signal from Singapore and Australia indicates this is moving from voluntary to required.
Key Points
- Enterprises that build governance into agent architecture from day one outperform those applying it as a retrofit
- The identity and access management market is undergoing a structural shift as non-human identities multiply faster than human ones
Timeline
Feb 2026
Gravitee report quantifies the governance gap: 43% of organizations use shared service accounts for agents
Feb 2026
Koi Security names ClawHavoc supply chain campaign targeting the OpenClaw agentic framework
Mar 2026
Nvidia NemoClaw launches in early preview with kernel-level sandbox enforcement and intent verification
Apr 2026
Anthropic Managed Agents launches in public beta with structural credential isolation and session durability
Apr 2026
RSAC 2026 produces cross-vendor consensus: AI governance is the largest unresolved gap in enterprise technology
Key Actors
Anthropic
Zero-trust agent architecture pioneer
Launched Managed Agents with a brain-hands-session split that structurally removes credentials from the execution sandbox
Nvidia
Runtime containment security vendor
Released NemoClaw with five stacked enforcement layers, intent verification, and complete audit logging inside a shared sandbox
Okta
Non-human identity governance advocate
Research cited in Fortune analysis shows only 10% of organizations have a clear AI agent management strategy, framing identity governance as the central enterprise gap
AWS / Kiro
Agentic development platform builder
Built spec-driven development into the Kiro IDE, enabling verifiable autonomous coding at enterprise scale with documented productivity outcomes
EdgeVerve
Enterprise agentic deployment operator
Deployed multi-agent systems in live CFO and facilities environments, producing a $32M cash-flow lift and 50% productivity gain as a documented production case
What This Means
Identity and agent governance are becoming new enterprise infrastructure spend categories
Markets
The combination of regulatory pressure, documented breaches, and RSAC-level vendor consensus will accelerate budget allocation toward non-human identity management, agent observability platforms, and zero-trust architecture tooling. Vendors who ship auditable, certifiable governance layers will command premium pricing and longer contract terms.
Zero-trust architecture for agents is now a shipping product category, not a research concept
Tech
With Anthropic and Nvidia both shipping architectures that answer the credential isolation question differently, enterprise security teams now have a concrete evaluation framework. The architectural choice between structural credential removal and policy-gated containment will define how organizations price and manage agent compromise risk in production.
Regulatory frameworks are beginning to assign organizational liability for automated system decisions
Policy
Singapore and Australia are already signaling that organizations bear responsibility for actions taken by their automated systems. This creates a compliance imperative for audit trails, access logs, and step-up authorization mechanisms that most enterprises currently lack. Proactive regulatory engagement will become a competitive differentiator for large enterprises.
Sources
VentureBeat
2 weeks ago
Fortune
2 weeks ago
VentureBeat
2 weeks ago
VentureBeat
2 weeks ago
winners
- Identity and access management vendors who extend their platforms to non-human agent identities gain a large and fast-growing addressable market
- Enterprises adopting spec-driven development gain verifiable, auditable agent behavior that satisfies both security and compliance requirements
- Cloud providers like AWS who embed governance tooling directly into agentic development environments capture sticky enterprise platform spend
- Security vendors with agent-specific zero-trust architectures, such as Anthropic and Nvidia, gain first-mover positioning in a market with no established standard
losers
- Organizations running monolithic agent containers with shared service accounts face the highest breach probability and the broadest blast radius
- Enterprises that deployed agents rapidly without lifecycle management will face significant remediation costs as regulatory scrutiny increases
- Security teams that failed to claim ownership of agent access controls are now inheriting liability that was never formally assigned to them
implications
- Agent governance is becoming a board-level risk item, not just an IT configuration decision
- The CISO role is expanding to include non-human identity governance, requiring new tooling, staffing models, and audit frameworks
- Procurement processes for enterprise software must now include agent-specific security criteria: credential isolation, session recovery, and indirect prompt injection roadmaps
minority report
- The governance urgency narrative may be overstated by security vendors with direct commercial interest in selling agent governance solutions, and the actual breach rate from ungoverned agents may remain low enough that most enterprises rationally defer investment
- Spec-driven development and zero-trust architectures add friction and cost that could slow adoption precisely when competitive advantage accrues to the fastest deployers, making the governance-first posture a strategic liability rather than an asset in fast-moving markets
Level 4
Second-Order Shocks Ahead
The governance gap is not a static problem waiting to be solved. It is a compounding one. As agents become ten times more capable within twelve months, as Kiro's lead architect projects, the authority they hold scales with that capability. The second-order consequences will emerge not from malicious AI behavior but from correctly configured agents operating inside systems that were never designed to account for their presence. The organizations that fail to build governance infrastructure now will face a future where the remediation cost is orders of magnitude higher than the prevention cost today.
Key Points
- Agent capability is projected to grow ten times within one year, meaning governance gaps that are manageable today become critical vulnerabilities at scale
- The indirect prompt injection vector remains unresolved by both leading architectures, representing the most exploitable attack surface in production agent deployments
Timeline
Feb 2026
ClawHavoc supply chain campaign confirmed: 1,184 malicious skills tied to 12 publisher accounts in the OpenClaw ecosystem
Mar 2026
Nvidia NemoClaw ships with intent verification and default-deny outbound networking as the first runtime containment architecture
Apr 2026
Anthropic Managed Agents ships structural credential isolation with 60% reduction in median time to first token
Apr 2026
RSAC 2026: CSA Agentic Trust Framework formally classifies the deployment-to-governance gap as a governance emergency
Q3 2026
Projected: Agent capability at 10x current levels per Kiro lead architect projection, amplifying all unresolved governance gaps
Key Actors
Cisco (Jeetu Patel / Matt Caulfield)
Action-control security framework advocate
Called for a shift from access control to action control at RSAC, framing continuous per-action verification as the new zero-trust standard for agents
CrowdStrike (George Kurtz / Elia Zaitsev)
Agent threat intelligence leader
Identified AI governance as the largest enterprise tech gap and highlighted ClawHavoc as the first major supply chain attack on an agentic framework
CSA (Cloud Security Alliance)
Governance standards body
Published the Agentic Trust Framework and survey data showing only 26% of organizations have AI governance policies, providing the authoritative baseline for the governance emergency claim
NCC Group (David Brauchler)
AI security architecture advisor
Advocates for gated agent architectures built on trust segmentation principles where agents inherit the trust level of the data they process
What This Means
The monolithic agent container pattern is a depreciating architectural asset
Tech
Security teams that audit now and flag shared service accounts will avoid the remediation cost of rebuilding agent deployments under regulatory pressure. The five-point audit framework from the CSA and RSAC consensus provides an actionable starting point: audit for monolithic patterns, require credential isolation in RFPs, test session recovery, staff for the observability model, and track indirect prompt injection roadmaps from vendors.
Agent security is a new infrastructure spend category with no dominant vendor yet
Markets
The first vendors to achieve certifiable, auditable zero-trust agent architectures with proven session durability and indirect prompt injection mitigations will command enterprise contracts at infrastructure pricing. The window for category leadership is open now and will close within 18-24 months as regulatory requirements crystallize around specific technical standards.
Organizational liability for automated decisions is becoming codified
Policy
The ability to answer three questions, where are my agents, what can they connect to, and what are they authorized to do, is transitioning from best practice to regulatory requirement. Organizations in regulated sectors should treat agent audit trail capability as a compliance deliverable on the same timeline as other mandatory controls.
Detected Trends
Non-human identity proliferation
accelerating
AI agents are creating a new class of operational identity that outnumbers human identities in enterprise environments, breaking every existing IAM model built on the assumption of human actors
Zero-trust agent architecture
emerging
Structural separation of agent reasoning, execution, and credentials is emerging as the primary architectural response to the governance gap, with Anthropic and Nvidia as the first two public implementations
Spec-driven autonomous development
accelerating
Using formal specifications as the trust anchor and correctness engine for autonomous coding agents is moving from experimental practice to enterprise baseline, compressing delivery timelines and enabling verifiable behavior at scale
Agent supply chain attacks
emerging
Adversaries are targeting agent skill repositories and frameworks as a new attack vector, as demonstrated by ClawHavoc, with a 36.8% security flaw rate in publicly available agent skills creating a systemic vulnerability
Sources
VentureBeat
2 weeks ago
Fortune
2 weeks ago
VentureBeat
2 weeks ago
VentureBeat
2 weeks ago
second order
- As agent fleets scale, the non-human identity population will exceed the human identity population inside most large enterprises, inverting the assumption underlying every existing security model
- The 29-minute average attacker breakout time documented by CrowdStrike, with a 27-second fastest observed, means that prompt injection exploits in production agents will propagate faster than human security teams can respond without automated countermeasures
- Supply chain attacks targeting agent skill repositories, as demonstrated by ClawHavoc, represent a new attack surface with no established defense standard and a 36.8% security flaw rate in publicly available agent skills
prediction
- Within 18 months, a major regulatory body in the EU or US will mandate agent identity logging and step-up authorization for financial and healthcare sector deployments, triggered by a high-profile breach traceable to an ungoverned agent
- Credential isolation will become a standard procurement requirement in enterprise RFPs within 12 months, effectively forcing monolithic agent vendors to rebuild their architectures or exit the enterprise market
- Indirect prompt injection will produce the first publicly attributed large-scale enterprise breach within 12 months, accelerating the architectural convergence toward structural credential removal over policy-gated containment
minority report
- The agent governance market may consolidate around a single dominant identity platform before specialized zero-trust agent architectures achieve widespread adoption, rendering the Anthropic versus Nvidia architectural debate moot as IAM incumbents absorb the use case
- Enterprises may rationally choose governance debt over governance investment if productivity gains from ungoverned agents outpace the actuarial cost of breaches, producing a long-term market equilibrium where governance remains perpetually underfunded relative to deployment velocity
Level 5
The Operator Playbook
For executives and practitioners making decisions now, the signal is clear: the governance gap is not a background risk to monitor, it is an active liability that compounds with every ungoverned agent deployment. The organizations that will extract durable value from agentic AI are not the ones deploying the most agents but the ones who can prove what their agents are authorized to do, demonstrate that access was appropriate at the time of every action, and revoke authority reliably when something goes wrong. That capability is not a future state. It is the minimum viable condition for sustainable enterprise agent deployment in 2026.
Timeline
Feb 2026
Gravitee and CSA data establishes the quantitative baseline: deployment velocity has outpaced security readiness by a 65-point gap
Mar 2026
Nvidia NemoClaw ships: first public zero-trust architecture using runtime containment and intent verification
Apr 2026
Anthropic Managed Agents ships: first public zero-trust architecture using structural credential isolation and session durability
Apr 2026
RSAC 2026 produces vendor-independent consensus on five audit priorities for enterprise security directors
Q2-Q3 2026
Projected: first major regulatory action in a financial or healthcare market mandating agent identity controls, triggered by a high-profile breach
Key Actors
Anthropic
Structural zero-trust architecture pioneer
Shipped the first structurally isolated agent architecture, eliminating credential proximity to execution as a blast radius control, with session durability and built-in tracing
Nvidia
Runtime observability and containment vendor
Shipped NemoClaw with the deepest runtime observability of any public agent architecture, trading autonomy for complete audit coverage inside a policy-enforced sandbox
Okta / Gravitee / CSA
Governance gap quantification coalition
Collectively produced the quantitative evidence base that transforms the governance gap from anecdote to measurable enterprise liability, enabling board-level risk framing
AWS / Kiro
Verifiable agentic development platform
Demonstrated that spec-driven development at enterprise scale produces verifiable, auditable code behavior with documented productivity multiples, anchoring the trust model for autonomous coding
CrowdStrike
Agent threat intelligence and defense lead
Surfaced the ClawHavoc supply chain attack and established the defense-in-depth framework for treating agents as highly privileged users requiring the same security depth as human administrators
What This Means
The architectural decision you make now determines your blast radius for the next three years
Tech
Choosing between structural credential isolation and policy-gated containment is not a theoretical debate. It determines whether a successful prompt injection yields a disposable container or a live credential. Security architects should audit every deployed agent against the five-point RSAC framework, require session recovery testing before production deployment, and build indirect prompt injection mitigations into vendor evaluation criteria today.
Agent governance is the next enterprise infrastructure category, and the category leader has not yet emerged
Markets
The IAM incumbents, cloud security vendors, and AI platform providers are all competing for ownership of non-human identity governance. The winner will be the one who achieves certifiable, auditable, regulator-acceptable agent lifecycle management at enterprise scale first. Investors should evaluate vendors on their ability to answer the three governance questions: where are agents, what can they access, and what are they authorized to do.
Proactive regulatory engagement is now a strategic lever, not just a compliance obligation
Policy
Organizations that engage with Singapore, Australian, and emerging EU and US regulatory frameworks on AI agent accountability now will shape the standards that their competitors must meet later. Building audit trail capability, step-up authorization, and agent offboarding processes ahead of mandate creates a compliance moat and positions the organization as a credible partner in standard-setting rather than a target of enforcement.
Detected Trends
Non-human identity governance
accelerating
The fastest-growing identity management challenge is not human users but AI agents operating continuously across enterprise systems with dynamically scoped, persistent access that no existing IAM framework was designed to manage
Agentic supply chain security
emerging
Agent skill repositories and orchestration frameworks are becoming high-value attack surfaces, with ClawHavoc demonstrating the first major supply chain campaign and a 36.8% security flaw rate in public agent skills establishing the baseline vulnerability level
Spec-driven autonomous development
accelerating
Formal specifications as the trust and verification anchor for autonomous coding agents are moving from experimental to enterprise baseline, with documented productivity multiples and verifiable correctness enabling the shift from assisted to continuous autonomous development
Regulatory codification of AI agent liability
pending
Policymakers in Singapore, Australia, and increasingly in the EU and US are moving toward formal requirements that organizations prove authorization, access appropriateness, and control over automated system decisions, converting the governance gap from a risk management question to a compliance imperative
Sources
VentureBeat
2 weeks ago
Fortune
2 weeks ago
VentureBeat
2 weeks ago
VentureBeat
2 weeks ago
implications
- Security and identity teams must formally claim ownership of non-human agent access controls now, before regulatory frameworks assign liability by default to whoever is easiest to hold accountable
- Agent procurement standards must require vendors to specify whether credential isolation is structural or policy-gated, and to provide a roadmap for indirect prompt injection mitigations, because these two dimensions determine the actual blast radius of a compromise
- Enterprises should treat agent lifecycle management, including versioning, scoped permissions, step-up authorization, and offboarding, as a non-negotiable baseline, not as a future optimization
second order
- The enterprises that build governance infrastructure into their agent platforms now will have an audit-ready compliance posture when mandatory regulatory requirements arrive, turning a cost center into a competitive moat against peers who deferred investment
- As agent capability compounds, the value of well-governed agents grows nonlinearly: a governed agent operating at ten times current capability is an enterprise asset, while an ungoverned agent at the same capability level is an existential liability
- The talent market will bifurcate between developers who understand spec-driven development and agent governance and those who do not, creating a new premium skill tier as consequential as the cloud-native engineering divide of the previous decade
minority report
- The entire governance-first framing may reflect a security industry preference for control over productivity rather than a genuine calibration of enterprise risk, and organizations that deploy fast with lightweight guardrails may outcompete governance-heavy peers by enough margin to absorb the occasional breach cost, suggesting the optimal enterprise posture is closer to risk-weighted speed than to compliance-driven caution
- Spec-driven development and zero-trust agent architectures may introduce enough overhead and brittleness that they are ultimately superseded by AI systems capable of self-governing through emergent alignment rather than external constraint, making today's governance investments a transitional cost rather than a durable foundation