The 90% That Already Happened
ServiceNow's survey of 3,700 security leaders found 90% of organisations had an agentic AI incident last year — and only 13% have a defensible programme.
26 October 2026 — For most of this year, the agentic security conversation was predictive. This week it became descriptive.
ServiceNow surveyed more than 3,700 security leaders for Deployed but ungoverned: the state of agentic security, and the headline finding is a base rate rather than a forecast: 90% of organisations worldwide had an agentic AI security incident in the past year. Of those, only 36% contained it in under 24 hours.
The more revealing number is not the incident rate. It is the collapse between what organisations believe about their posture and what they can evidence.
Most leaders describe their agentic governance as established. Measured against five domains — attack surface, accountability, security by design, visibility, audit readiness — only 13% have a programme that holds up. The gap between "established" as a self-description and "defensible" as a finding is where the risk sits.
Three further ratios make the machine-speed problem concrete. Seventy-six percent claim a complete, current map of every agent's access; only 19% can see more than 90% of their agents in real time. The organisations that can actually observe their agents are a minority within a minority.
And then there is the calendar. The 2 December Article 50(2) marking deadline sits 37 days out. EN 18286:2026 — the first harmonised standard supporting the AI Act, published in the Official Journal via Commission Implementing Decision (EU) 2026/2274 on 19 October — covers quality management systems under Article 17, not the marking requirement itself. Almost no small-business adviser has read it, and most assume it does their Article 50 work for them. It does not.
What this means if you run an SME. Take the 13% seriously. It is not a claim about your competitors being negligent; it is a measurement of how hard these five domains are to satisfy simultaneously. Most organisations can name their agents. Fewer can say what each can reach. Very few can prove, after the fact, what one did.
Start with visibility, because it is the prerequisite for everything else. Ask whether you could answer, today, which of your agents ran in the last 24 hours and what they touched. If the answer is no, that is the work — and it is more useful than any policy document you could write instead.
This article concludes the Monday series. It was reconstructed from the delivered briefing, as no vault file was written that week.