Agentic security: Enterprises enforce agent permissions two-thirds of the time - and isolate high-risk agents less than one in five

Across 116 enterprises, agents are in production and so are the incidents: A majority have already had a confirmed agent security event or a near-miss. Two-thirds of enterprises enforce scoped permissions at runtime. Barely one in five isolates its highest-risk agents, making containment the weakest layer in the stack precisely as autonomy scales. Credential sharing persists across nearly two-thirds of agent fleets, and 53% have already had a confirmed agent security event or near-miss, contributing to a growing lack of confidence in agentic security. Security stacks remain overwhelmingly borrowed from model providers and hyperscalers, and confidence has slipped. Today, as many enterprises now believe AI-armed attackers are ahead of their defenses as believe the reverse. This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers. Only 18% of enterprises isolate their highest-risk AI agents, even as 65% of enterprises enforce scoped permissions at runtime and 56% monitor and log agent activity. The gap between what enterprises watch and what they contain is the central finding of this wave of VentureBeat Pulse Research. More than half of enterprises (53%) have agentic AI systems in production today, and another 27% are piloting or running a limited rollout. The agentic security incidents are arriving with them: 53% of organizations have already had an agent security event, with 19% confirming an incident and 38% having identified a near-miss that was caught before it caused harm. The central finding is a containment gap. Enterprises have built the controls that watch and permission agents but not the one that bounds the damage when those fail. Among enterprises describing their security posture, 65% enforce scoped identities and permissions at runtime and 56% observe and log agent activity, yet only 18% isolate high-risk agents in sandboxes. Even among enterprises running agents in production, isolation is enforced just 21% of the time, and just 8% pair enforcement with isolation. That ordering is backward from a defense-in-depth standpoint. From SOC teams to CISOs, security teams know that observation tells you what happened and enforcement tries to prevent it, but isolation is what limits the blast radius when prevention fails. Identity has improved without being solved. 49% of enterprises say each of their agents has its own scoped, managed identity, but 63% report credential sharing somewhere in the agent fleet, and only 29% describe a fleet with scoped identities and no sharing anywhere. The security stack doing this work remains overwhelmingly hyperscaler or model provider-native: OpenAI’s guardrails (44%), Microsoft Azure (42%), Anthropic’s managed-agent controls (37%), and Google Cloud (31%) lead, and 92% of enterprises naming a primary security layer name a hyperscaler/model provider-native one. Two things have shifted against the comfortable picture. Confidence has slipped, with 30% now saying AI-armed attackers are ahead of their defenses, exactly as many as say their defenses are ahead. And churn intent is the highest this series has recorded, with 74% planning to adopt, add, or replace agent security tooling within twelve months, despite satisfaction scores at a series high of 4.29 out of 5. Enterprises are more satisfied than ever with a stack they are more determined than ever to replace. Methodology VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security - the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=116; the survey’s smallest size band, 1-100 employees, is excluded), drawn from a single July 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends; all figures are drawn from the July fielding only. Several questions were multiple-select, so those shares can sum to more than 100%. By role the sample is senior and buyer-credible: 44% are final decision-makers for AI purchases and another 38% recommenders or influencers. Managers (36%), individual contributors (27%), VPs and directors (18%), and the C-suite (16%) make up the seniority mix. By organization size the sample is mid-market-weighted with a meaningful enterprise tail: 101-250 (34%) and 251-1,000 (23%) employees lead, with 1,001-5,000 (18%), 10,001+ (17%), and 5,001-10,000 (7%) above them. Technology/Software is the largest industry at 38%, followed by Healthcare/Life Sciences (11%) and Financial Services (10%). Three questions require a base note. Two questions were asked only of enterprises with agents live or piloting. Posture figures (observe / enforce / isolate) are reported on those 93 respondents, and primary-security-layer figures on the 92 of them who named a layer. The 23 respondents outside this base are those still evaluating, without plans, or unsure - organizations for which an agent security posture would not yet apply. And several multiple-select questions permitted overlapping answers where one was intended - identity (33 respondents selected more than one pattern), arms-race assessment (23), budget share (10), and incidents (9) - so those are computed at the respondent level and the overlap is described where it matters. Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 76 of the 116 qualified respondents. At 116 respondents, the sample supports directional reads but not precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up agent security rather than from the largest operators. Finding 1: Agents are in production, and so are the incidents A majority have already had an agent security event We asked whether organizations run agentic AI in production, and whether they had experienced an agent security incident - a confirmed breach, or a near-miss caught before harm. Finding 1 - Agents Are in Production, and So Are the Incidents Agents have moved into production for this cohort. More than half of enterprises (53%) run agentic AI systems live today, another 27% are piloting or running a limited rollout, and only 3% have no plans in the next twelve months. The security exposure has scaled with the deployment: 53% of organizations have already had an agent security event, 19% a confirmed incident and 38% a near-miss caught before it caused harm. That the near-misses outnumber confirmed incidents two to one is worth reading carefully. It means enterprises are catching problems, but catching them close to the edge - and a near-miss is a control that worked once, not a control that will work every time. The controls examined in the rest of this report, particularly the identity and isolation gaps in Findings 2 and 3, are what determine whether the next near-miss stays a near-miss. One pattern from earlier waves does not replicate here. Organization size makes no reliable difference to exposure: enterprises above 1,000 employees report an incident or near-miss at 47%, against 57% among those between 101 and 1,000 - a difference well inside sample noise, and pointing the opposite direction from the size gradient this series has previously recorded. In this wave, what separates the hit from the not hit is not headcount. Finding 2: Identity is improving - and still shared Half give agents scoped identities; two-thirds still share credentials somewhere We asked how enterprises manage the identity of their AI agents - whether each agent has its own credentials, or agents share them. Respondents could describe more than one pattern across the fleet. Finding 2 - Identity Is Improving - and Still Shared Per-agent identity is now the most-cited pattern: 49% of enterprises say each agent carries its own scoped, managed identity, the precondition for least-privilege access and clean attribution. That is real progress on the control this series has repeatedly identified as the structural weakness beneath agent incidents. But the answers overlap, and the overlap is the finding. Thirty-three respondents described more than one identity pattern across their fleet, and rolled together at the respondent level, 63% of enterprises report credential sharing somewhere - either agents mostly running on shared API keys and borrowed human or service-account credentials (37%), or a mixed fleet where some agents are scoped and many are not (34%). Only 29% describe a fleet with scoped identities and no sharing anywhere at all. Among enterprises with agents in production, 60% report per-agent identity, so the improvement is concentrated where the agents actually are - but so is the residual sharing. The consequence is unchanged by the improvement. Where credentials are shared, an over-permissioned or compromised agent acts with far more reach than intended, and post-incident forensics cannot cleanly establish which agent did what. Half a fleet with scoped identities still has the blast radius of the half without. Non-human identity remains the largest unfinished piece of enterprise agent security, and as Finding 8 shows, it is still almost entirely absent from what enterprises are shopping for. Finding 3: Isolation is the control nobody builds Two-thirds enforce at runtime; fewer than one in five sandbox We asked what an organization’s agent security posture looks like in practice - whether they observe, enforce, isolate, or some combination. The control that bounds damage is by far the least common. Figures are reported on the 93 respondents who described a postu