In the rapidly evolving landscape of AI agent security, a critical gap emerges: the lag in isolation measures despite robust enforcement and observation. Across 116 enterprises, the majority have already encountered confirmed agent security incidents or near-misses, underscoring the urgency of addressing this vulnerability. While two-thirds of these organizations enforce scoped permissions at runtime and 56% monitor and log agent activity, a staggering 79% fail to isolate their highest-risk agents, leaving containment as the weakest link in the security stack. This oversight is particularly concerning as autonomy scales, emphasizing the need for a comprehensive defense-in-depth strategy.
The root of this issue lies in the persistent credential sharing across nearly two-thirds of agent fleets, which exacerbates the risk of over-permissioned or compromised agents. This sharing hinders post-incident forensics and contributes to a growing lack of confidence in agent security. The security stack, dominated by hyperscaler and model provider-native controls, fails to address this critical gap, with only 18% of enterprises isolating their highest-risk AI agents.
What makes this situation particularly intriguing is the contrast between satisfaction scores and churn intent. Enterprises rate their current agent security tooling highly, with an average satisfaction of 4.29 out of 5. However, a staggering 74% plan to adopt, add, or replace this very same tooling within 12 months. This paradox highlights the tension between comfort with existing solutions and the recognition of underlying vulnerabilities.
The budget allocation further underscores this dichotomy. While a third of enterprises now dedicate more than a tenth of their security budget to agent security, the majority (65%) allocate only 6-10%. This disparity suggests that while enterprises acknowledge the importance of agent security, they are yet to fully invest in the necessary controls, particularly isolation and governed identity.
The arms race between AI-enabled defenses and attackers has tilted, with 30% of enterprises believing attackers are ahead. This pessimism is driven by experience, as those who have faced confirmed incidents or near-misses are more likely to perceive the balance as unfavorable. Despite this, the high satisfaction scores indicate a disconnect between perceived security and actual vulnerabilities.
The consideration set for new agent security solutions reveals a focus on provider-native controls, with OpenAI, Microsoft Azure, and Anthropic leading the way. However, the absence of agent identity and runtime sandboxing/isolation tooling in this consideration set is striking, given their direct implications in the incident data. This suggests that enterprises are prioritizing convenience and low friction over comprehensive security, potentially leaving them vulnerable to the very threats they aim to mitigate.
In conclusion, the agent security landscape is characterized by a critical containment gap, exacerbated by persistent credential sharing and a reliance on provider-native controls. The high satisfaction scores and churn intent highlight a need for a more nuanced understanding of security vulnerabilities, with a focus on addressing the gaps in isolation and governed identity. As enterprises continue to embrace AI agents, the urgency of closing this containment gap cannot be overstated, as it is the key to ensuring the resilience and safety of these powerful tools.
