Two numbers from the same survey, published this year, describe the entire state of enterprise AI agents.
And runtime visibility is the generous version of the question — it asks what agents are doing, not what they could do. The inventory question is harder, and the survey didn't even get to ask it. The distance between those two numbers is not a rounding error. It is the gap between a sentence and an inventory. A policy is a sentence: "agents may not act outside approved scope." Visibility is an inventory: here are our agents, here is what each one can reach, here is who answers for it. One of these survives an audit. The other one is a belief — and you can't audit a belief.
This is the fourth article in this series, and it completes a pattern the first three kept circling. Every Agent Is a Principal Now argued that agents with credentials are security principals whether you treat them that way or not. Code Got Cheap. Trust Didn't. showed generation scaling while verification didn't. Attackers Don't Have to Be Right argued that verification cost decides where autonomy can safely go. This one is about what happens when you stop looking at a single agent and look at the population: capability is scaling like software. Accountability is still scaling like headcount.
Where we actually are
Start with the growth curve. Gravitee's State of AI Agent Security 2026 — a survey of 900 executives and technical practitioners in the US and UK, published in February — found that enterprise agent deployments roughly doubled in a single quarter, with 38% of organizations reporting more than 100 agents already in production. In the same population: 88% reported a confirmed or suspected agent-related security incident in the last year, mean monitoring coverage sits at 52%, and only 14.4% of agents went live with full security and IT approval.
Read that last number again. It is not saying agents are dangerous. It is saying that roughly six out of seven production agents entered service the way shadow IT always has: because someone needed the output and nobody owned the question.
Meanwhile, the output is real. A field study of Microsoft's early-2026 rollout of command-line coding agents — tens of thousands of engineers, developer-level telemetry, a four-month window — found adopters merged roughly 24% more pull requests than they would have otherwise, and that adoption spread primarily through social networks: engineers copied what they saw working next to them, not what a policy told them to use. The authors are careful to say a merged PR is not the same as delivered value. But the lift persisted, and it was measured, not surveyed.
And the humans in the loop are not naive about any of this. The Stack Overflow developer survey has 84% of developers using or planning to use AI tools while trust in their accuracy fell to 29%, with only 3% reporting high trust and 46% actively distrusting the output. Adoption and skepticism are rising together. People use the tools because they work often enough, and distrust them because they know exactly how they fail.
Put the three datasets side by side and the picture is coherent: agents produce measurable output, spread laterally faster than governance can follow, and accumulate credentials and access along the way. The bottleneck of this phase of automation is not what agents can do. It is whether anyone can enumerate what they can do — and name who answers when one of them does something else.
An honest caveat before building on those numbers, because this series has a rule about arguing against its own evidence. Gravitee sells API and agent governance — its survey diagnoses precisely the disease its product treats. "Confirmed or suspected" incidents is a generous bucket. And surveys measure belief, which is an uncomfortable foundation for an article about the difference between belief and inventory. That is why the Microsoft study matters to this argument: it is telemetry, not testimony. The direction of the survey numbers is corroborated by the one dataset here that doesn't rely on anyone's self-assessment — adoption is social, fast, and bottom-up. Precision I'd discount; direction I'd bet on.
The trajectory
Two projections, both from Gartner in mid-2025, look contradictory and aren't: over 40% of agentic AI projects canceled by end of 2027 (cost, unclear value, inadequate risk controls — and an ecosystem where, by their estimate, only ~130 of thousands of "agentic" vendors sell the real thing), and 15% of day-to-day work decisions made autonomously by 2028, up from zero in 2024.
Culling and embedding at the same time. That is what every infrastructure transition looks like from the inside. The projects die; the capability stays and concentrates in the deployments that survived — which are, disproportionately, the ones that could answer the boring questions: what does this agent touch, who owns it, what happens when it's wrong.
If the current data holds, the visibility gap closes one of two ways. Either tooling absorbs it — agent inventories, scoped credentials, and monitoring become platform defaults the way asset inventories and SSO did, and the 21% climbs without anyone's discipline improving — or incidents force it, and enumeration arrives the way most security controls historically arrived: attached to an audit finding, an insurance questionnaire, or a regulator's letter, after the expensive lesson rather than before it.
The limits of this extrapolation are real. The growth numbers come from vendors with a stake in urgency. "Doubled in a quarter" off a small base is less dramatic than it sounds. And the incident statistics don't distinguish an agent leaking a customer database from an agent posting to the wrong Slack channel — severity distribution is the load-bearing unknown in every claim above, including mine.
What if...
This section is speculation, clearly flagged. Each scenario may or may not happen; each comes with what would need to be true for it to materialize.
What if the agent inventory becomes a compliance artifact? The software supply chain went through exactly this: SBOMs moved from good-practice obscurity to procurement requirement in a few years, pushed by incidents and then by mandate. An "agent bill of materials" — what runs, what it can reach, who owns it — is the same shape. What would need to be true: at least one agent-caused incident large enough to reach regulators or insurers with a clear "nobody could enumerate what it had access to" finding; audit frameworks naming agents explicitly; procurement checklists following. The 88%-incident number says the raw material exists. What's missing is the incident that becomes the story everyone cites.
What if the org chart absorbs the agents? Not metaphorically — literally: teams carry a roster of agents with a named human owner each, onboarding and offboarding procedures, scoped access granted and revoked like any employee's, performance reviewed against a written mandate. The 82%-believe / 21%-can-see gap exists precisely because agents currently live in the gap between HR (which tracks people) and IT asset management (which tracks machines) — and they are neither. What would need to be true: identity providers treating agents as first-class principals with lifecycle, not service accounts with a password in a vault; cost accounting that makes agent labor visible per-team; and management practice catching up to the fact that "how many reports do you have" now has a second answer.
What if the gap never closes — and mostly never matters? The counter-speculation, arguing against my own thesis. Shadow IT was supposed to be an existential crisis too; decades of unmanaged SaaS later, most of it was absorbed, not detonated. Maybe agent incidents stay small and cheap, monitoring commoditizes into platforms by default, and "agent sprawl" ends up like browser tabs: theoretically horrifying, practically fine. What would need to be true: incident severity stays flat while agent privileges grow — which is the one assumption in this article I'd least like to defend, because privilege accumulation is precisely what the surveys show happening, and severity tends to follow privilege with a lag.
What I'm doing about it
I run a fleet of about twenty scheduled agents. They research, write, monitor, apply, and publish — real credentials, real output, every day. The fleet's operating rules were not designed from a framework; they accreted from failures, which is the only pedigree I trust. Three of them are this article's thesis in miniature.
Scope is written before the first task, not after. No agent enters the roster without a written mandate: what it does, what it must never do, and who (me, or a coordinating agent with a recorded verdict) approves what. This isn't bureaucracy — it's the difference between "I think it only reads" and an answer that survives a question. The 14.4%-full-approval number describes fleets built the other way.
State lives in files anyone can read — and one file outranks everyone's memory. Every agent writes what it did, and a single canonical state document outranks any individual agent's stale assumptions. When an agent finds reality diverging from the record, the rule is: report the divergence, never silently patch it. An unreported divergence is how one agent's small error becomes the next agent's confident action.
Production outranks documents. The newest rule, and it cost something to learn: an internal status file claimed a page wasn't live when it had been deployed for four days, and an agent trusting the document over the URL triggered a false escalation. Now the rule is written: for any claim about what's live, the evidence is the live URL, never a status line. Inventories drift. The audit that matters checks the world, not the paperwork.
The honest limit: with a fleet this size, my inventory fits in one file I can hold in my head. The entire argument of this article is that this does not scale by discipline alone — which is exactly why the 21% number is worth watching. It measures how many organizations have turned a belief into something they can point at. Everyone else is one incident away from finding out which one they had.
Next week: the field rotates to applied AI — what actually survives when the demo becomes a workload.
Research home: blackicelabs.ca