Eighty-Two Confident, Twenty-One Informed
Gravitee's data put agentic security on the boardroom agenda with a number: 82% of executives are confident, and 21% have audited visibility. The gap is the risk.
12 October 2026 — Every so often a survey produces a number that does the work of an entire argument. This week produced two.
Gravitee's State of AI Agent Security 2026 found that 82% of executives are confident in their organisation's agentic security posture. Twenty-one percent have audited visibility into what their agents actually do. Between those two figures sits the largest unexamined risk in most boardrooms — not a lack of ambition, but a confidence that was never tested against evidence.
The rest of the survey fills in the shape. Eighty-eight percent of organisations reported at least one agentic security incident. The mean cost of an agentic breach is now $4.7 million. Security budget allocated to agents: six percent.
That last figure explains the other three. If agents receive 6% of the security budget while accounting for an increasing share of incidents, then the 88% incident rate is not a surprise. It is a budget allocation working exactly as designed.
Two supporting developments are worth noting. The ratio of non-human identities to human ones now runs between 80:1 and 144:1 in many organisations — a population that cannot be phished, cannot be trained, and does not notice that its credentials are being used somewhere new. And the "blameless breach" pattern is now well documented: post-incident investigations consistently find that the agent acted inside its granted permissions, and that nobody remembered granting them.
There is also a practical cost story moving the other way. Claude Haiku 5.5 cut small-model inference cost by 75 to 90 percent, which makes deploying many small agents far cheaper — and therefore makes the population under management grow faster, right as the governance gap widens. Cheaper agents mean more agents. More agents mean more identities nobody owns.
Article 50 marking sits 51 days out.
What this means if you run an SME. Ask the question the survey asks: not "are we confident", but "have we audited". Pick your five most privileged agents or integrations and trace what each can reach. If you cannot complete that exercise in a day, you have found the work, and it is worth doing before it is worth discovering.
Nineteenth in a weekly series on the developments that matter to small and mid-sized organisations.