VB Intelligence surveyed people at organizations with 100 or more employees, and consultants serving such organizations, in September 2026. We asked how enterprises identify their AI agents, how fast they could shut one off, and whether agents have caused security incidents.
Executive summary
Few enterprises could stop a misbehaving AI agent quickly. Only 14% say a named owner could revoke an agent's access within minutes. Another 45% say a security or platform team could do it within hours, and 27% say it would take more than a day, would require tracing the agent's credential first, or might not reach every agent.
How an enterprise identifies its agents is linked to how fast it could stop one. Among enterprises whose agents share credentials, 30% say shutting off an agent would be slow or uncertain, against 9% of enterprises that give each agent its own identity.
Yet shared credentials are common. Only 34% of enterprises say each agent has its own identity, 44% say some or most agents share credentials, and 22% do not know how their agents are identified. Even among enterprises that say they enforce each agent's permissions, 43% say some or most agents share credentials.
Agents are already causing security problems. Of the enterprises surveyed, 39% had an AI agent cause a confirmed security incident or a near-miss in the past 12 months. Those enterprises are more likely to plan new agent security within a year: 88% against 68% of enterprises that had neither.
Most enterprises secure their agents with the controls built into their AI providers' platforms. Of enterprises using agent security tools, 68% use controls from OpenAI, Anthropic, Google Cloud, Microsoft Azure or AWS, against 31% that use a specialist security vendor.
Finding 1. Enterprises whose AI agents share credentials are three times as likely to say shutting one off would be slow or uncertain
30% of enterprises whose agents share credentials say so, against 9% of enterprises that give each agent its own identity.
Revoking an agent's access is how a security team stops an agent that misbehaves or is hijacked. When each agent has its own identity, the team can revoke that one credential. When agents share a key or run on a person's login, the team first has to trace which credential the agent used, and revoking that credential can cut off every other agent using it too.
We asked who could revoke an agent's access if it had to be shut down immediately, and how long it would take.
Finding 1 — Who could revoke an agent's access, and how fast
Base: 100 qualified respondents who answered; two skipped the question. One answer each.
Of enterprises that answered, 17% would need more than a day or would have to trace the credential first, and 10% are not certain they could revoke every agent's access. Together, 27% say shutting off an agent would be slow or uncertain.
Finding 1 — Revocation speed, by how agents are identified
Bases: 44 enterprises whose agents share credentials wholly or partly, and 34 that give each agent its own identity, among those that answered both questions. One answer each.
Among enterprises whose agents share credentials, 30% say shutting off an agent would be slow or uncertain, against 9% of enterprises that give each agent its own identity. The difference is statistically significant, though both groups are small, so the October Pulse will test whether it holds.
Finding 2. Only 34% of enterprises give each AI agent its own identity, and 22% do not know how their agents are identified
Even among enterprises that say they enforce each agent's permissions at runtime, 43% say some or most of their agents share credentials.
When several agents share one API key, or run on a person's own login, the credential identifies the key or the person instead of the agent. Shared credentials make it harder for a security team to trace an action to one agent, and an agent on a person's login can reach much of what that person can reach.
We asked how the organization handles credentials and identity for AI agents in production.
Finding 2 — Credential handling for AI agents
Base: 102 qualified respondents. One answer each. The methodology explains why the base is not limited to enterprises with agents in production.
Of the enterprises surveyed, 44% say some or most of their agents share credentials, and 22% do not know.
Finding 2 — Credential handling, among enterprises that say they enforce permissions
Base: 40 enterprises that chose "Enforce: agents have scoped identities and permissions, enforced at runtime" to describe their agent security program. One answer each. Shares are rounded, so they sum to 101%.
That answer option says agents have scoped identities. Yet 43% of the enterprises choosing it say some or most of their agents share credentials, and only 48% say each agent has its own identity. What these enterprises say about their security program and what they say about their credentials do not match.
Finding 3. 21% of enterprises cannot say how many AI agent identities they run
At the other end, 26% say they run 250 or more distinct agent identities.
An agent identity is the service account, application key or managed identity an agent uses to act, as opposed to a person's login. Not knowing how many exist makes it harder to check that each one has an owner, an expiry date and a way to be revoked.
We asked approximately how many distinct AI agent identities the organization has in production.
Finding 3 — Distinct AI agent identities
Base: 97 qualified respondents who answered; five skipped the question. One answer each.
Of enterprises that answered, 21% have no count of their agent identities or do not know how many they have. At the other end, 19% run 250 to 999 agent identities and 7% run 1,000 or more.
Finding 4. 39% of enterprises say an AI agent caused a security incident or near-miss in the past year
21% report a confirmed incident, and another 12% do not track agent incidents at all.
An agent holds the permissions someone gave it, so it can take an unauthorized action or expose data with no outside attacker involved. An attacker who hijacks an agent inherits the agent's permissions. A near-miss means a control caught the agent before harm, which does not show the same control will catch the next one.
We asked whether an AI agent had caused a security incident or near-miss in the past 12 months, such as an unauthorized action, a data exposure or a hijacked agent.
Finding 4 — Agent-caused security incident or near-miss, past 12 months
Base: 102 qualified respondents. One answer each. Shares are rounded, so they sum to 101%.
We also asked whether the organization plans to adopt a new, additional or replacement agent security solution in the next 12 months.
Finding 4 — Plan to adopt new agent security within 12 months
Bases: 40 enterprises that had a confirmed incident or near-miss, and 50 that had neither. Enterprises that do not track incidents are left out. One answer each. Shares are rounded, so the first group sums to 101%.
Of enterprises that had an incident or near-miss, 88% plan to adopt new agent security within 12 months, against 68% of those that had neither. Across all enterprises surveyed, 74% plan to adopt new agent security within 12 months.
Finding 4 — Share of security budget on AI and agent security
Base: 102 qualified respondents. One answer each. Shares are rounded, so they sum to 101%.
Of the enterprises surveyed, 57% put 10% or less of their security budget into AI and agent security, and 12% do not know the share.
Finding 5. 68% of enterprises secure their AI agents with their AI providers' built-in controls, against 31% that use a specialist vendor
OpenAI's guardrails are used by 23%, Anthropic's controls by 20%, Google Cloud's by 15% and Microsoft Azure's by 12%.
Enterprises can secure agents with controls built into the model and cloud platforms the agents run on, or with specialist tools that sit apart from those platforms. Built-in controls come with the platform, while specialist tools can watch agents across several platforms.
We asked which agent security vendors, platforms or approaches the organization uses today.
Finding 5 — Agent security tools in use
Base: 99 qualified respondents who named at least one tool. Several answers allowed, so shares sum past 100%. The specialist figure counts each respondent once and leaves out Microsoft Entra Agent ID, named by 1%, and runtime sandboxing, shown separately. Other specialist tools named by under 5% are not shown.
OpenAI's guardrails are used by 23% of enterprises with agent security tools, Anthropic's controls by 20%, Google Cloud's by 15% and Microsoft Azure's by 12%. Taken together, 68% use at least one of the five model and cloud providers' controls, and 31% use a specialist vendor.
Finding 5 — Rating of agent security tools, average out of 5
Base: 92 enterprises that named a tool and rated their tools, or 88 for value for money.
Finding 6. 39% of enterprises say they enforce each AI agent's permissions as it runs, and 31% mainly watch and log what agents do
Another 16% run high-risk agents in a sandbox, and 9% have no dedicated agent security program.
Observing means monitoring and logging what agents do, which tells a security team what happened. Enforcing means checking each agent's permissions at runtime, which tries to stop an agent before it acts. Isolating means running high-risk agents in a sandbox, which limits the damage when an agent gets past other controls.
We asked which best describes the organization's agent security program today.
Finding 6 — Agent security program
Base: 102 qualified respondents. One answer each.
The enforce answer is the most ambitious of the three programs, and Finding 2 shows that many enterprises choosing it still let agents share credentials.
Finding 7. 24% of enterprises now say it is too early to tell whether attackers or defenders have the edge with AI, up from 6% in August
25% say their AI-enabled defenses are ahead, and 18% say attackers using AI are ahead.
Attackers can use AI models to find and exploit software flaws, and security teams can use them to defend.
We asked who has the advantage in the organization's security today, as frontier models grow more capable at finding and exploiting vulnerabilities.
Finding 7 — Who has the advantage
Base: 102 qualified respondents. One answer each. Shares are rounded, so they sum to 102%.
The share saying it is too early to tell rose to 24% from 6% in August.
What changed since the August Pulse
We asked the questions below in the same words in August and September. The first group shows the changes that are statistically significant.
What changed: statistically significant
What changed: statistically significant
Statistically significant means the difference passes the test described in the methodology. Bases, August then September: all respondents 137 and 102.
More September respondents said it is too early to tell who has the advantage.
What did not change: statistically insignificant
What did not change: statistically insignificant
Statistically insignificant means the difference does not pass the test described in the methodology, so we cannot tell whether the figure moved. Bases, August then September: 137 and 102.
What we did not compare
We did not compare the agent security tools enterprises use. September's screening questions changed who qualified for the survey, so we will first compare tool use between September and October, the first two months screened the same way.
We did not compare the incident, credential or budget questions. The August report used enterprises running agents as the base, and we did not ask in September whether agents are in production or in a pilot.
We did not compare the primary security layer, which we asked only of respondents who answered late in the month. The questions on agent identity counts and revocation are new in September.
The bottom line: Few enterprises could shut off a misbehaving AI agent quickly, and those whose agents share credentials are the least prepared
Only 14% of enterprises say a named owner could revoke an agent's access within minutes. Among enterprises whose agents share credentials, 30% say shutting off an agent would be slow or uncertain, against 9% of enterprises that give each agent its own identity. Only 34% of enterprises give every agent its own identity.
Of the enterprises surveyed, 39% had an agent cause a security incident or near-miss in the past year. We did not test whether giving each agent its own identity prevents incidents.
In the next Pulse, VB Intelligence will measure whether more enterprises give each agent its own identity, and whether the share that could revoke an agent within minutes rises.
Respondent profile
| Respondent type | Respondents |
|---|---|
| Works on AI for the organization that employs them | 52% (53) |
| Consultant who works on AI for client organizations | 48% (49) |
Base: 102 qualified respondents. One answer each.
| Organization size (main client, for consultants) | Respondents |
|---|---|
| 100–250 employees | 31% (32) |
| 251–1,000 employees | 26% (27) |
| 1,001–5,000 employees | 15% (15) |
| 5,001–10,000 employees | 13% (13) |
| 10,001 or more employees | 15% (15) |
Base: 102 qualified respondents. One answer each.
| Job level | Respondents |
|---|---|
| Manager | 31% (32) |
| Individual contributor | 23% (23) |
| C-suite | 11% (11) |
| Partner or principal | 11% (11) |
| Director | 10% (10) |
| VP | 9% (9) |
| Other | 6% (6) |
Base: 102 qualified respondents. One answer each. Shares are rounded, so they sum to 101%.
| Industry (main client, for consultants) | Respondents |
|---|---|
| Technology or software | 15% (15) |
| Education | 10% (10) |
| Retail or e-commerce | 10% (10) |
| Healthcare or life sciences | 9% (9) |
| Manufacturing | 9% (9) |
| Telecommunications or media | 8% (8) |
| Transportation or logistics | 8% (8) |
| Government or public sector | 8% (8) |
| Professional services or consulting | 7% (7) |
| Financial services, banking or insurance | 4% (4) |
| Energy or utilities | 3% (3) |
| Other or not stated | 11% (11) |
Base: 102 qualified respondents. One answer each. Shares are rounded, so they sum to 102%.
Methodology
VB Intelligence fielded this VB Pulse survey in September 2026 and received 113 responses, of which 102 qualified. Respondents qualified if they work at an organization with 100 or more employees, or consult for one as their main client with direct access to its AI systems.
We excluded analysts, academics and journalists, staff at technology vendors serving their own customers, consultants who do not work directly on AI systems, and organizations or clients under 100 employees.
Consultants answered about the client organization where they spent the most time on AI work. Of the consultants, 39% have day-to-day access to that client's AI systems and the rest partial or periodic access.
The credential and identity-count questions asked about agents in production, but we did not ask in September whether agents are in production. Those figures therefore use every respondent who answered, and the answers include "Don't know."
We added a question on the primary security layer late in the month, so only 16 respondents saw it. We do not report it.
We recorded one answer per respondent on the question about agent security tools under consideration, although the question allowed several. We do not report it.
We recorded no respondent as using open-source guardrails, although two respondents named open-source guardrails as their primary layer. The tools figures may therefore understate open-source use.
Apart from the open-source guardrails answers described above, we found no respondents whose answers about their own organization contradicted each other, so no figure needs to be shown both ways. Choosing the enforce answer while reporting shared credentials is a gap between stated program and practice, which we report as a finding.
We did not record in-house respondents' role in AI purchasing, so the profile leaves that question out.
The question on agent security tools in use allowed several answers. Its figures count people, not selections.
Some groups in this report have fewer than 40 respondents: enterprises giving each agent its own identity, 34. Percentages for groups this small are less precise; for a group of 38, a result could differ by about 15 percentage points either way from the true figure.
A difference counts as statistically significant only when its test gives p below 0.05. Two percentages from separate groups use the two-proportion z-test, or Fisher's exact test when either group has fewer than 40 respondents. Two answers to a one-answer question use an exact binomial test. Unless a sentence says otherwise, every difference between groups or between August and September that this report describes passed its test. Differences that fail are described as statistically insignificant or left out of the text.
We do not compare tool use with August, because the September screening questions changed who qualified. The first comparison of tool use will be between September and October.
Because the September screening questions differed from August's, a change from August counts only when it passes the test twice: on all September respondents and on September's in-house respondents alone.
VB Intelligence surveys a self-selected group of VentureBeat readers and panel respondents. The results describe those respondents, not every enterprise, and apply to the wider market only as far as this mix of respondents allows.
Published by VB Intelligence. © 2026 VentureBeat. All rights reserved.