Here is the practical takeaway first: if your organization runs AI agents in production and hasn't audited credential sharing or isolation practices, you are statistically likely to have already had a security event — you may just not know it yet. A June 2026 VentureBeat Pulse survey of 107 enterprises (100+ employees) found that 54% have experienced either a confirmed agent security incident (18%) or a near-miss caught before damage occurred (36%). Only 42% report a clean record.
The structural problem underneath those numbers is identity. Only 32% of surveyed organizations give every agent its own scoped, managed identity. The remaining 68% have credential sharing somewhere in their agent fleet — shared API keys, borrowed human credentials, or service-account tokens passed across multiple agents. The consequence is a wide blast radius: when one over-permissioned or compromised agent acts, it can reach everything its shared credentials can touch, and post-incident forensics can't cleanly attribute actions to a specific agent. Organizations with full per-agent scoped identities had an incident-or-near-miss rate of 41%; those with credential sharing anywhere hit 64% — a 23-point gap within a single survey wave.
Isolation is even rarer than proper identity. About half of enterprises monitor agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% sandbox their highest-risk agents to limit damage when the other controls fail. That ordering is backwards: observation tells you what happened, enforcement tries to prevent it, but isolation is what contains the damage when prevention breaks down. Larger enterprises are actually worse on this measure — sandbox adoption drops from 35% in the mid-market to 20% at companies above 1,000 employees, even as their incident rates climb to 63%.
The security stack itself is almost entirely borrowed. OpenAI's built-in guardrails lead adoption at 51%, followed by Google, Microsoft, and Anthropic's native controls. When asked to name their primary security layer, 82% of respondents named a provider-native offering. Purpose-built agent-security vendors — Palo Alto Prisma AIRS, Zenity, HiddenLayer, Okta for AI Agents, non-human identity platforms — each register in the low single digits. This pattern held across both Q2 survey waves. The provider bundle is winning by default, and it was not designed to solve the identity and isolation problems the incident data points to.
What makes this gap dangerous is the confidence sitting on top of it. Satisfaction with current agent security tooling averaged 4.2 out of 5 — among the highest scores in the series. Yet only 35% believe their AI defenses are ahead of AI-enabled attackers, 53% call the contest even or attacker-favored, and 59% plan to adopt new or replacement tooling within twelve months (29% within the next quarter). Among organizations that have already had a confirmed incident, the urgency sharpens: 53% plan to change tooling within 90 days, versus 14% of those with no incident. Satisfaction is high; conviction that it's working is not.
What builders and security leads should do with this: start with non-human identity. Assign every agent its own scoped credential with least-privilege access — this is the single control most directly correlated with lower incident rates in this data. Next, sandbox your highest-risk agents; only 30% have done this, which means it's a genuine differentiator. Then audit your reliance on provider-native guardrails: they are a reasonable starting layer, but they were not designed to handle credential scoping, inter-agent attribution, or blast-radius containment. Budget allocation is also lagging — 80% of surveyed enterprises spend 10% or less of their security budget on agent security, while the incident rate suggests the risk deserves a larger share. The agent security gap won't close by itself; it closes when organizations build the identity and isolation layer that autonomous software actually requires.