Presented by Ping Identity

Enterprises need to treat zero trust security architecture as an immediate requirement for AI agents rather than a long-term goal, says Andre Durand, CEO and founder of Ping Identity. Zero trust, the security model built on the assumption that no user, device, or system should be automatically trusted, requires continuous verification before every action rather than a single check at login. Agentic AI has profoundly compressed the risk timeline enterprises must manage, demanding that permission decisions be evaluated in real time.

That compression shows up in how permissions accumulate. Every time an employee approves an AI agent’s request for access to a company drive, a database, or a code repository, the enterprise hands over a sliver of control that looks routine in isolation. Across thousands of agents making thousands of requests, those approvals accumulate into an exposure that most existing security architectures were never built to measure.

“The rise in desire to use agents right now, and the speed of agentic, is highlighting the need to move faster on the principles of zero trust,” Durand says. “Agents just move faster, full stop. A human compromise might be measured in minutes or hours, sometimes days. At agentic speed, a thousand actions could happen in five minutes.”

Why zero trust is now urgent for agentic AI

That difference in velocity changes how enterprises need to think about permissions. Two variables matter: the surface area of access an agent is granted and the duration that access remains valid. Traditional identity and access management tends to grant broad permissions and leave sessions open for extended periods because the human using them moves at human speed. Zero trust, in contrast, collapses both variables at once by narrowing access down to what is strictly necessary and revalidating it continuously, rather than once at login.

“Zero trust really just says, just enough, just in time,” Durand says. “It’s your next action that we care about. We’re moving identity from an era where access was our runtime control point — meaning were you logged in, did you have a session — toward the decision that sits behind that login.”

Why agents must be treated as first-class identities

That shift to decision-based control has direct implications for how agents should be provisioned in the first place. The common practice of letting an agent operate under a cloned human login or a shared service account doesn’t work, Durand says.

“Each agent should have its own identity,” he explains. “It should not be impersonating the human. It can act on behalf of the human, we could explicitly delegate authority to an agent, but we don’t want to blur the lines between the human taking action and the agent taking action.”

And beyond that is another concern: the shared secrets, API keys in particular, that many service accounts still rely on. For example, the habit of embedding keys directly in source code, where they can be committed accidentally and exposed, is a convenient but weak security pattern that agentic workflows make considerably riskier. Building service account architectures that let agents authenticate without relying on those shared credentials or other long-lived standing access is now an urgent priority rather than a long-term cleanup project.

Where enterprises can enforce zero trust policies

Enforcing any of this in practice requires identifying where policy can actually be applied. Several existing choke points, including API gateways and the agent gateway sitting in front of MCP servers, offer practical locations where enterprises can inspect what an agent is requesting and apply policy rules before granting it.

“Those policies could leverage real-time risk and fraud signals, and then enforce, deterministically, what the agent can do when it interacts with these systems,” Durand explains.

The goal is to move authorization from something decided once at login to something evaluated at the moment of every consequential action, such as an agent attempting to commit code to a repository. Instead of carrying a standing permission to write to GitHub, the agent’s request would be checked against context and policy at that specific moment, closing the window of trust down to the scope of a single action.

Stopping AI agents from rewriting their own permissions

That model becomes especially important given how agents can behave once they are already inside a system — for example, coding agents that have acknowledged, when questioned, either ignoring a specific guardrail entirely, or attempting to rewrite the permissions they were given.

“Who’s watching the watcher? Zero trust needs to apply here,” Durand says. “If generative AI systems follow your instruction 97% of the time, and you’re simply asking it for advice, that might be fine. If it’s responsible for making a decision about who gets let in, 97% is not good enough.”

How to trust AI-generated output at agent speed

The answer to that gap is not to eliminate AI from the review process, but to structure reviews so no single agent’s judgment is taken at face value. Because human review cannot scale to the volume and speed of agentic output without erasing the advantage of using agents at all, a new framework is necessary, so that when one agent produces work, such as code, separate agents evaluate it, provided those reviewing agents are kept from communicating with one another or with the one they are checking. It’s a new human-AI paradigm, Durand says.

“We probably will have to develop frameworks that we trust without seeing or verifying the output directly,” he explains. “It’s not that that construct is 100% foolproof. However, it’s the best we can do to move at agent speed. We can’t trust the exact output, but we can trust the framework.”

In practice, that means combining automated review with clear human accountability for higher-risk decisions, rather than treating agent output as self-validating.

For traditional auditors, reviewing every transaction individually is never feasible, and statistically valid sampling stands in for full verification. The same applies to risk accumulation: a single agent action might carry little risk on its own, while a sequence of actions moving in a consistent direction could cross a threshold that triggers an intervention, including a kill switch capable of halting the agent before further harm occurs.

What to ask when evaluating agentic identity platforms

For security leaders evaluating identity platforms for agentic AI, there’s no narrow checklist. Enterprises should evaluate what their full lifecycle of agent management looks like. Most enterprises are managing agents on two fronts simultaneously: customer-facing agents acting on behalf of external users, and internal agents deployed to automate enterprise processes.

“Pause long enough to see the totality of what it would mean to secure multiple agents, both interacting with you from the outside as well as being deployed on the inside,” Durand says. “We need discovery and visibility of all the agents operating within our estate, a place to register them, a standard way to assign custodians, and a way to construct and centralize policy so security can enforce it across the organization.”

And while basic security principles were already fully understood before agentic AI arrived, what has changed, Durand says, is that the cost of moving slowly has finally caught up with the cost of moving carelessly, giving enterprises a narrowing window to build the right architecture before widespread agentic adoption makes retrofitting far more expensive.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Keytec brought the Magic Touch to the 1994 Summer Consumer Electronics Show in Chicago. The Texas company, founded in 1987, offered a straightforward way to give standard CRT monitors and notebook screens touch input without replacing the entire display. At a moment when keyboards and mice defined personal computing, the idea of pressing a finger directly on the glass stood out as genuinely forward-looking.

The Magic Touch’s hardware took the shape of a framed overlay, similar to a plastic frame with a clear adhesive membrane inside. This membrane rested on top of whatever monitor you were using at the moment, with a nice border that matched the forum’s standard beige or black color scheme. Within this jumble of layers was a brilliant innovation: an invisible spacer system that kept the whole device light and didn’t interfere with your view while also protecting the screen from scratches. The membrane handled roughly 80% of the display, which isn’t awful, and it was strong enough to withstand the ordinary 3H pencil scratch.

Sale

InnoView 15.6″ Portable Monitor 60Hz Touchscreen 1080P 10-Point Touch Screen Monitor Portable with…

• [10-Point Touchscreen Portable Monitor]: Portable screen compatible with Windows and MacOS systems. You can get touch function for your laptop by…
• [Get a Monitor Protective Sleeve]: The case is tailor-made for your portable laptop monitor, lightweight and durable, easy to carry, a perfect…
• [FHD IPS Portable Display]: 15.6 inch 1080P portable screen for laptop adopts a real reliable IPS screen with a viewing angle of 178°. Compared with…

To make things work, you needed a little external controller. Early versions were connected via an obsolete serial port, whereas subsequent versions just used USB. The panel simply hooked into the controller, and many configurations provided power via the computer connection, eliminating the need for a bulky power brick on your desk. The items were offered in a number of sizes, ranging from 12 to 17 inches for poor laptops to 13 to 24 inches for desktop displays, with larger cousins appearing in related products. It was very simple to install; simply attach some clips or brackets for large desktop monitors that would clip over the top of the bezel, or use adjustable straps for laptops to keep everything in line with the screen. You finished in a few minutes, and the old screen was as good as new underneath.

Once everything was set up and connected, you’d need some software to instruct the touchpad what to do. This would convert all of the touchy feely inputs into mouse operations. You’d go through a simple calibration process to get the pixels and the membrane in line. Then you could choose whether to click on contact or lift off to get the device to work, and you could even change for left or right hand preference, as well as temporary right click on using a software toggle. It performed all of the standard mouse actions: cursor movement, single clicks, double taps, and drags. The touch resolution was great and high, 4096 by 4096 points, and the entire thing responded to finger pressure, which ranged from 50 to 120 grams per square centimeter.

The effectiveness of the system was determined by the software being used. Big buttons on interface elements functioned perfectly with a finger or a stylus, and menu navigation was simple. You’re probably familiar with some of the older action games, which were more hit and miss. Because of the small physical space between the membrane and the screen, you had to make sure you had everything set up correctly for those tiny targets; otherwise, you’d have bizarre parallax, and glare may be an issue, especially if you had a shiny display. It also took some force to work, albeit not much.

After completing the initial Magic Touch launch, the company continued to develop subsequent versions that worked with a variety of operating systems and connection methods. They made this type of device until 2017, when it was handed over to a new business that continued to create custom touch-focused solutions for a variety of monitors and panels. Nowadays, you can get very much the same idea, just updated, and still purchase a Magic Touch-style gadget to convert an old display into a touchscreen.

AI AND ML

Adapting existing local LLM project for security and sovereignty purposes and hopes to one day match Mythos

South Korea is developing its own security-focused AI model and hopes to bring it online by the end of the year, to ensure the nation has sovereign bug-finding capabilities.

Deputy Prime Minister and Minister of Science and ICT Bae Kyung-hoon revealed the effort to create the model yesterday, and said it’s needed so South Korea possesses a bug-finding model to rival Anthropic’s Mythos.

The US government has twice blocked access to Mythos, once by requiring Anthropic to offer it only to American citizens – a demand the AI company could not meet and therefore blocked all access – and a second time by ordering the company to take down its services so Washington could investigate allegations of possible dangerous performance problems.

Those incidents led many other nations conclude that the US could in future deny access to powerful models – meaning US-based organizations and national security agencies would have an edge. Washington has since allowed limited access to Mythos to some of its allies.

Interest in developing sovereign AI capacity has nonetheless soared, and Bae said South Korea now aspires to develop its own Mythos-class model. The Register is aware of another effort to create Mythos-like tools, involving private firms and infrastructure operators across several countries.

In South Korea, the government’s approach is to add security-related information to the corpus it is using to train a locally developed frontier model. The minister said he expects that security-capable model will debut by the end of 2026.

South Korea has also sought bids to create a chatbot that will be made freely available to all residents, plus an agentic application that will help locals interact with government services.

Minister Bae made his remarks at a policy briefing session conducted by President Lee Jae Myung, during which discussions about AI also touched on using the technology to detect fake news in real time, and put it to work handling complaints about government services more quickly than is currently possible. ®

Roblox announced Build on Wednesday, a new creation tab inside the Roblox mobile app that lets anyone turn a text prompt into a basic playable game without touching Roblox Studio or writing a line of code. A creator can describe something like a cozy forest adventure game with environmental obstacles, and Build will generate a starting point with gameplay mechanics, environment, characters, sound, and visual style. The feature begins public alpha testing in New Zealand on July 28 for age-verified users nine and older.

Build shares a back end with Roblox Studio, meaning creators can start a project on their phone and continue refining it on desktop with the full Studio toolset, or launch agents from Studio and check progress from mobile. The system is powered by a mix of open-source and proprietary Roblox AI models trained on what the company describes as a uniquely large set of 3D models and gaming-specific data. Roblox’s Cube foundation model, which the company introduced earlier this year alongside agentic Studio tools, generates game-ready objects that can drive, shoot, or otherwise behave as expected without manual scripting.

Roblox said it is aware of the quality risk that comes with lowering the barrier to game creation. The company said its discovery system ranks games by long-term retention, not recency or volume, and that games nobody plays will not surface on the homepage regardless of how they were made. Published games from Build will go through the same safety checks and retention-based discovery ranking as all other Roblox titles, and games targeting younger players will undergo an extended review before being added to the Roblox Kids or Select catalogues.

Alongside Build, Roblox is shipping a suite of agentic tools for professional creators over the coming months. These include a playtesting agent that finds bugs before players encounter them, an analytics agent that answers questions about game performance in plain language, and an experiment agent that identifies tests to improve engagement and monetisation. A new scene-generation model is also in development that will create entire editable and playable 3D environments from a single text prompt.

The announcement comes as AI-generated content is flooding platforms faster than review systems can handle it, a dynamic that drove an 84 percent jump in App Store submissions and prompted Apple to crack down on low-quality AI-built apps. Roblox is betting that its retention-based discovery system will serve as a natural quality filter, surfacing only games that players actually want to keep playing.

A base version of Build will be free, with paid options for power users. The rollout will expand to more regions after the New Zealand alpha, and Roblox said it plans to share further creation tool announcements in the coming months. The platform has 132 million daily active users, any one of whom could now prototype a game from their phone.

Roblox is putting AI game creation inside its mobile app, giving more people a faster way to turn a written idea into a playable experience without starting in Roblox Studio.

The company will begin a public alpha of Build in New Zealand on July 28, 2026. The mobile-first AI tool turns text prompts into playable games inside the Roblox app and will include publishing among its selected early features.

Build adds a creation tab to the mobile app. A user can describe a game in ordinary language, and Build will generate an initial project with gameplay mechanics, environments, characters, visual styling, sound, and other elements.

Creators can playtest the result, request changes through chat, share the project with friends, or continue working in Roblox Studio. Build and Studio share the same back end, models, and chat history, so a project started on a phone can move into the company’s more advanced desktop tools.

Roblox is positioning Build as an easier entry point for people who have a game idea but don’t already use Studio. The creation platform reports 132 million daily active users and wants more of those players to become creators.

The initial rollout will remain limited. During the New Zealand alpha, Build is scheduled to be available to age-checked users 9 and older, although age requirements may vary by region.

Roblox is positioning Build as an easier entry point for people who have a game idea but don’t already use Studio. Image credit: Roblox

Build-created games that pass Roblox’s safety checks will be available worldwide to age-checked users 16 and older. Games must also complete Roblox’s extended review process before entering its Kids or Select catalogs.

Roblox plans to expand Build to more creators and regions after the New Zealand alpha, but it hasn’t announced a broader rollout schedule.

Build combines open-source models with Roblox’s proprietary AI systems. Roblox says its models use gaming-specific data and a large collection of 3D models to generate functional objects and scenes.

Roblox is also developing AI tools for professional creators. Planned agents will identify bugs, answer plain-language questions about analytics, and suggest experiments tied to engagement, retention, and monetization.

Some of the underlying technology is already available. Procedural Models generate adjustable 3D assets from text or images, while Roblox’s Cube foundation model can create functional objects, including vehicles that drive and weapons that shoot.

Roblox also plans a scene-generation model that will create editable, playable environments from a single prompt. The company hasn’t announced a release date.

Faster creation puts more pressure on discovery

Faster game generation could increase the number of repetitive or unfinished projects competing for attention. Roblox addressed that concern directly in its announcement.

The company said its discovery system prioritizes long-term retention, which Roblox argues excludes what it called “AI slop,” and Build-created games will compete in the same candidate pool as other experiences.

A basic version of Build will be free, with paid options planned for creators who need additional capabilities. Image credit: Roblox

Roblox argues that games that fail to attract players will remain difficult to discover under its retention-based ranking system. Faster generation could still leave Roblox with more projects to review, rank, and moderate as Build reaches additional markets.

A basic version of Build will be free, with paid options planned for creators who need additional capabilities. Roblox hasn’t disclosed pricing or identified which features will require payment.

Build can shorten the path to a first playable project, but generating a game isn’t the same as making one people want to keep playing. Roblox’s discovery system will help decide which Build projects find an audience and which disappear into the platform’s growing catalog.

Amazon’s $400 discount on Apple’s high-end 16-inch MacBook Pro with an M5 Max chip and 2TB SSD is available now, with delivery as early as tomorrow for Prime members.

The M5 Max 16-inch MacBook Pro is on sale for $3,999 at Amazon in your choice of Space Black or Silver. This high-end configuration has Apple’s M5 Max chip with an 18-core CPU and 32-core GPU, along with 36GB of unified memory and a spacious 2TB SSD.

Save $400 on M5 Max 16″ MacBook Pro

Amazon’s $400 discount delivers the lowest price available per our 16-inch MacBook Pro Price Guide, with the next lowest price coming in at $4,189 at Expercom.

In our hands-on 16-inch MacBook Pro review, we found the M5 Max chip is blazing fast and we were happy to see the laptop now supports Wi-Fi 7.

You can also find MacBook Pro deals on M5 Pro 14-inch and 16-inch models in our Price Guides, with a few highlights below.

Today’s top 16-inch MacBook Pro deals

• 16″ MacBook Pro M5 Pro (18C CPU, 20C GPU, 24GB, 1TB, Standard Display, Space Black): $2,818.34 ($181 off)
• 16″ MacBook Pro M5 Pro (18C CPU, 20C GPU, 48GB, 1TB, Standard Display, Space Black): $3,299 ($300 off)
• 16″ MacBook Pro M5 Max (18C CPU, 32C GPU, 36GB, 2TB, Standard Display): $3,999 ($400 off)
• 16″ MacBook Pro M5 Max (18C CPU, 40C GPU, 48GB, 2TB, Standard Display): $4,499 ($500 off)

Best 14-inch MacBook Pro discounts

• 14″ MacBook Pro M5 (10C CPU, 10C GPU, 16GB, 1TB, Standard Display): $1,849 ($150 off)
• 14″ MacBook Pro M5 Pro (18C CPU, 20C GPU, 24GB, 2TB, Standard Display): $2,997.50 ($202 off)

Don’t expect that number to shrink any time soon.

Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents still share credentials; and only three in ten isolate their highest-risk agents. The security stack is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents, spending remains a thin slice of the security budget, and enterprises are evenly split on whether their defenses are keeping pace with AI-enabled attackers. The result is an agent security gap — autonomous agents proliferating faster than the identity, isolation, and enforcement controls needed to hold them.

This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers.

The central finding is an agent security gap — the distance between the autonomy enterprises are granting their agents and the controls in place to contain them. More than half of organizations (54%) have already experienced a confirmed agent security incident (18%) or a near-miss caught before harm (36%). The structural weakness beneath those numbers is identity: only about a third (32%) give every agent its own scoped, managed identity, while the rest report that some agents share credentials or that agents mostly run on shared API keys and human or service-account credentials. When agents share credentials, a single compromised or over-permissioned agent carries a wide blast radius — and only three in ten enterprises (30%) isolate their highest-risk agents in sandboxes to bound that radius.

What makes the gap notable is how comfortable enterprises are inside it. The security stack is overwhelmingly provider-native — OpenAI’s guardrails (51%), Google’s and Microsoft’s cloud controls, and Anthropic’s managed-agent controls dominate, while the dedicated agent-security specialists barely register — and satisfaction with that borrowed stack is high, averaging 4.2 out of 5. Yet spending remains a thin slice of the security budget, only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to change tooling within the year. Enterprises are satisfied with controls they are simultaneously preparing to replace.

Methodology

VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%.

By role the sample is senior and buyer-credible: 45% are final decision-makers for AI purchases and another 30% recommenders or influencers. Managers (43%), individual contributors (24%), VPs and directors (15%), and the C-suite (11%) make up the seniority mix. By organization size the sample is mid-market-weighted: 251–1,000 (42%) and 101–250 (25%) employees lead, with 1,001–5,000 (19%), 5,001–10,000 (8%), and 10,001+ (7%) above them. Technology/Software is the largest industry at 23%, followed by Manufacturing (15%), Retail/E-commerce (14%), and Healthcare/Life Sciences (13%).

At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent security rather than from the largest operators.

Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents.

Finding 1: The incidents are already here

More than half have had an agent security incident or near-miss

We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had.

This is the report’s defining number. More than half of organizations (54%) have already had an agent security event — 18% a confirmed incident and 36% a near-miss caught before it caused harm. Only 42% report nothing, and a small remainder either run no agents in production or don’t track such events. That so many report near-misses rather than only confirmed incidents is telling: enterprises are catching problems, but they are catching them close to the edge. The controls examined in the rest of this report — identity, isolation, enforcement — are what determine whether the next near-miss stays a near-miss.

Exposure scales with company size, but containment does not. The incident-or-near-miss rate rises from 49% in the mid-market (companies with 101-1,000 employees) to 63% at larger enterprises (above 1,000 employees), while sandbox isolation of high-risk agents falls from 35% to 20%, and satisfaction with security tooling drops from 4.36 to 3.97. The organizations running the most agents across the most systems carry the most incidents and the least of the one control that bounds an incident’s blast radius.

Finding 2: The identity gap

Only a third give every agent its own scoped identity

We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception.

Rolled together, the overlapping answers show 69% of enterprises (74 of 107) with credential sharing somewhere in the agent fleet. Identity is the structural weakness beneath the incidents. Only about a third of enterprises (32%) give every agent its own scoped, managed identity — the precondition for least-privilege access and clean attribution. Nearly half (48%) say some agents have scoped identities but many still share credentials, and another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. (Respondents could describe more than one pattern across their agent fleet, so these overlap.)

The consequence is direct: when agents share credentials, an over-permissioned or compromised agent can act with far more reach than intended, and forensics after an incident cannot cleanly tell which agent did what. The non-human identity problem — giving every agent its own governed identity — is the single largest unfinished piece of enterprise agent security.

Moreover, a company’s agent credential posture is correlated with incidents. Organizations with credential sharing anywhere in the fleet were hit — with an incident or a near-miss in the past twelve months — at 63.5% (47 of 74). Organizations where every agent carries its own scoped identity were hit at 40.9% (9 of 22). The fully-scoped group is small, so for now the relationship is an association rather than proven causation, and the gap is concentrated in the mid-market — but within a single survey, a twenty-three point difference in incident rate suggests significance.

Finding 3: Observe and enforce, but rarely isolate

Only three in 10 sandbox their highest-risk agents

We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common.

Monitoring and enforcement are reasonably common; containment is not. Roughly half of enterprises observe agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% isolate their highest-risk agents in sandboxes that bound the blast radius when the other controls fail. That ordering is backwards from a defense-in-depth standpoint: observation tells you what happened, enforcement tries to prevent it, but isolation is what limits the damage when prevention fails — and it is the control enterprises have adopted least. Combined with the identity gap in Finding 2, the picture is of agents that are watched and permissioned but rarely boxed in, which is precisely the configuration in which a single failure propagates.

Finding 4: Security runs on borrowed, provider-native controls

Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register

We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors.

Enterprises are securing agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 51%, followed by Google’s and Microsoft’s cloud-native controls and Anthropic’s managed-agent controls — and when asked to name their single primary security layer, 82% name one of these provider-native offerings. The purpose-built agent-security category — Palo Alto’s Prisma AIRS, CrowdStrike, Cisco AI Defense, Zenity, HiddenLayer, Check Point’s Lakera, Okta for AI Agents, non-human identity platforms — barely registers, each in the low single digits, and only 5% run no dedicated tooling at all. As with retrieval and evaluation elsewhere in this series, the provider bundle is winning the default: enterprises reach first for the guardrails their platform ships, and the independent security layer that would address the identity and isolation gaps has not yet been adopted at scale.

The provider-default pattern is consistent across both Q2 survey waves. In April–May (n=110), usage was led by the same names — OpenAI’s controls at 26%, Azure at 15%, AWS at 14%, Google at 12% — with every dedicated agent-security specialist at 3% or below and one in ten using no dedicated tooling at all. The common finding from the two surveys: Enterprises are defaulting to the solutions provided by the platform they’re using, and the specialist category vendors have yet to become big players here.

(A note on reading these shares. As described in the methodology section, the respondent sample is self-selected and skews mid-market, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern, however, held across both Q2 waves on two differently worded questions: provider-native and hyperscaler controls lead, and dedicated agent-security specialists remain in low single digits. Read the individual shares loosely and the pattern with confidence.)

Finding 5: And enterprises are comfortable with it

Satisfaction is high, even as incidents mount and identity lags

We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above.

Satisfaction with agent security tooling is high — 4.2 out of 5 overall, and 4.1 for value for money — among the most positive readings in this series. That is the striking part: enterprises are highly satisfied with a stack that is mostly borrowed provider guardrails, even though more than half have already had an incident or near-miss and only a third give their agents scoped identities. The comfort appears to rest on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is a false comfort in the making — the same enterprises expressing satisfaction are, as Finding 8 shows, a clear majority planning to change tooling within the year, which suggests the confidence is thinner than the score implies.

Finding 6: Budgets haven’t caught up

Most spend under a tenth of the security budget on agents

We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest.

Spending on agent security is still a thin slice. The most common allocation is 6–10% of the security budget (46%), and a third of enterprises (34%) spend 5% or less; only a quarter (24%) devote more than a tenth. Given the incident rate in Finding 1 and the identity and isolation gaps in Findings 2 and 3, the budget looks like a lagging indicator — the risk has arrived faster than the funding to address it. The enterprises spending more than a tenth of their security budget on agents are a distinct minority, and they are likely the ones building the scoped-identity and isolation controls the rest have not.

Only a third think their AI defenses are ahead of AI-enabled attackers

We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled.

Enterprises are split on whether they are winning. Only about a third (35%) believe their AI-enabled defenses are ahead of AI-enabled attackers; the rest are less sure — 32% call it roughly even, 21% think attackers are ahead, and another 21% say it is too early to tell. Taken together, a clear majority (53%) rate the balance as even or tilted toward the attacker. That uncertainty sits uneasily beside the high satisfaction of Finding 5: enterprises are content with their tooling yet unconvinced it is winning the contest it exists to win. In a domain where the offense is also compounding with AI, an even race is not a comfortable place to be.

Finding 8: A security reshuffle is coming

Nearly six in 10 plan to adopt or switch tooling within a year

We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat.

The security stack is not settled. While 41% have no plans to change, a clear majority (59%) intend to adopt a new, additional, or replacement agent security solution within twelve months, and 29% within the next quarter — a strong signal that, high satisfaction notwithstanding, enterprises know the current stack is provisional. Incidents are what start the buying cycle.

Among organizations that have been hit, 42.1% plan to adopt, add, or replace agent security tooling within the next ninety days, against 14.0% of organizations with no incident — and after a confirmed incident it becomes majority behavior, at 52.6%. Getting hit also changes the threat assessment: 33.3% of hit organizations say AI-armed attackers are ahead of their defenses, against 8.0% of the unhit. Experience, in this data, is the strongest predictor of both urgency and pessimism.

The consideration set still leans provider-native (OpenAI 34%, Google 30%, Anthropic 29%, Azure 25%), but the dedicated security vendors — Cloudflare, Cisco, Palo Alto, Okta, Check Point’s Lakera — draw early interest in the mid-to-high single digits, more than their current footprint. 

What the shopping does not yet include is the identity layer specifically. Twelve percent of the respondents include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set, and among the credential-sharing organizations that have already had an incident, identity consideration is essentially unchanged, at roughly one in ten. The control most directly implicated by the incident data is the one largely missing from the purchase plans. Whether this wave hardens the provider-native default or finally opens the door to purpose-built agent security — the identity and isolation controls the incidents call for — is the question this series will keep tracking.

The bottom line: A security gap that autonomy will test first

Organizations with more than 100 employees are giving AI agents real reach into systems and data while securing them with controls built for something else. More than half have already had an incident or near-miss; only a third give every agent its own scoped identity, and most still share credentials; only three in ten isolate their highest-risk agents; and the stack doing this work is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents.

The uncomfortable pairing is confidence with exposure: satisfaction with the current tooling is among the highest in this series, yet spending is a thin slice of the security budget, only a third believe their defenses are ahead of AI-enabled attackers, and a clear majority are already planning to replace what they have. At 107 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: agent adoption is running ahead of agent security, and the controls that matter most when something fails — scoped identity and isolation — are the ones enterprises have built least. The agent security gap is not a coverage problem that a provider guardrail will close on its own; it is a problem of identity, isolation, and enforcement built for autonomous software. The open question for later waves is whether enterprises close it deliberately — or whether a confirmed incident closes it for them.

Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read, not a precise measurement — the sample is self-selected and skews mid-market, so it’s best read as the view from organizations actively standing up agent security rather than from the largest operators. Respondents are senior and buyer-credible (45% final decision-makers, 30% recommenders/influencers), spanning managers through the C-suite, and drawn primarily from Technology/Software, Manufacturing, Retail/E-commerce, and Healthcare/Life Sciences.