VentureBeat Intelligence surveyed 102 people working on AI at organizations with 100 or more employees, and consultants who work on AI for such organizations, in October 2026. We asked whether AI agents caused security incidents or near-misses; who could revoke an agent's access and how quickly; how enterprises manage their agents' identities and credentials; and which security tools they use.
Executive summary
Of surveyed enterprises, 46% say an AI agent caused a confirmed security incident or a near-miss in the past 12 months: 6% a confirmed incident and 40% a near-miss caught before harm. Asked about the most significant case, 68% of those enterprises say it was caught internally with no external impact. Another 28% say data was exposed to someone inside the organization who should not have seen it.
Of enterprises reporting an incident or near-miss, 79% plan to adopt a new, additional or replacement agent security solution within 12 months, compared with 47% of those reporting no incident or near-miss.
Revoking an agent's access is one way to stop an agent that misbehaves. Of surveyed enterprises with AI agents in production or in a pilot, 49% say a named owner could revoke an agent's access within minutes. Another 36% say a security or platform team could do it within hours. And 12% say it would take more than a day or require tracing the credential first.
How an enterprise identifies its agents is linked to how quickly it says it could revoke an agent's access. Among enterprises that give each agent its own identity, 60% say a named owner could revoke an agent’s access within minutes, against 33% of enterprises whose agents share credentials.
Of surveyed enterprises, 57% say each AI agent in production has its own scoped, managed identity, and 39% say some or most agents share credentials.
Asked which agent security tools they use today, respondents who named at least one tool named four on average. Among those respondents, Anthropic's controls were named by 72%, OpenAI's guardrails by 64% and Microsoft Azure's controls by 57%.
Finding 1. Respondents hit by an AI agent incident or near-miss are far more likely to plan to adopt new security tools
79% of them plan to adopt a new, additional or replacement agent security solution within 12 months, against 47% of respondents who reported no incident or near-miss.
We asked whether, in the past 12 months, the organization had a security incident or near-miss caused by an AI agent, such as an unauthorized action, a data exposure or a hijacked or manipulated agent.
Finding 1 — Agent-caused security incident or near-miss, past 12 months
Base: 102 qualified respondents. One answer each. "Don't know" is a new answer in October.
We asked enterprises that reported an incident or near-miss to think of the most significant instance and say what happened as a result.
Finding 1 — What happened in the most significant case
Base: 47 enterprises that reported a confirmed incident or near-miss, the group the question was shown to. One answer each.
Of the 41 enterprises that reported a near-miss, 24% say data was exposed to someone inside the organization who should not have seen it, and one says a regulatory, legal or disclosure obligation was triggered. Respondents count some internal data exposures as near-misses.
We also asked whether the organization plans to adopt a new, additional or replacement agent security solution in the next 12 months. Of enterprises that reported an incident or near-miss, 79% plan to do so, compared with 47% of those that reported no incident or near-miss.
Bases: 47 enterprises that reported an incident or near-miss, and 51 that answered No.
Finding 2. Respondents whose organizations give each AI agent its own identity are nearly twice as likely to be able to shut one down within minutes
60% of respondents that said their organizations give each agent its own identity say a named owner could revoke an agent’s access within minutes, against 33% of enterprises whose agents share credentials.
An agent can act under its own managed identity or use a key or account shared with other agents or people.
We asked enterprises with AI agents in production or in a pilot who could revoke an agent's access if it had to be shut down immediately, and how long it would take.
Finding 2 — Who could revoke an agent's access, and how fast
Base: 89 enterprises with AI agents in production or in a pilot, the group the question was shown to. Three who answered "Don't know" to the agent-identity count did not see it. One answer each.
Finding 2 — Revocation, by how agents are identified
Bases: 36 enterprises whose agents share credentials wholly or partly, and 53 that give each agent its own identity, among the 89 above. One answer each.
The slow end shows the same split. Of enterprises whose agents share credentials, 28% say revoking access would take more than a day or require tracing the credential first, against 2% of those that give each agent its own identity. Both differences, in revocation within minutes and in revocation that takes more than a day or a credential trace, are statistically significant. The survey did not test whether giving each agent its own identity makes revocation faster.
Finding 3. 33% of respondents who say they enforce AI agent permissions still let agents share credentials, undercutting those controls
Of respondents whose program enforces scoped identities and permissions at runtime, 33% say some or most of their agents share keys or accounts with other agents or people. A shared key cannot be revoked for one agent without cutting off every agent and person using it.
We asked how the organization handles credentials and identity for AI agents in production.
Finding 3 — Credential handling for AI agents in production
Base: 101 qualified respondents. One who answered that the organization has no agents in production is left out. One answer each. The methodology shows the figures for enterprises with agents in production or in a pilot.
We also asked which best describes the organization's agent security program today. Of the enterprises choosing "Enforce: agents have scoped identities and permissions, enforced at runtime," 65% say each agent has its own identity, 33% say some or most agents share credentials, and one does not know.
Base: 52 enterprises that chose the Enforce answer.
We asked enterprises with AI agents in production or in a pilot approximately how many distinct AI agent identities they have in production.
Finding 3 — Distinct AI agent identities in production
Base: 92 enterprises with AI agents in production or in a pilot, the group the question was shown to. One answer each.
Finding 4. 20% of respondents have no automated way to detect an AI agent’s unauthorized action
They name no automated control and no monitoring alert among the ways they would find out, relying instead on employees, security team spot checks, or customers, partners and suppliers.
We asked how the organization would normally find out that an AI agent had taken an unauthorized action or exposed data it should not have.
Finding 4 — How the organization would normally find out
Base: 102 qualified respondents. Several answers allowed, so shares sum past 100%.
Of the 101 enterprises that named at least one way they would find out (everyone except one respondent who answered only Don’t know), 30% named exactly one and 43% named three or more.
We asked enterprises that describe their program as "Observe: we monitor and log agent activity, but runtime enforcement is limited" what normally happens next when monitoring flags unusual agent activity. Of them, 73% say a named owner is alerted and is expected to act within a defined window, 15% say who acts depends on who notices, and 12% say activity is logged and reviewed periodically.
Base: 26 enterprises that chose the Observe answer, the only group asked.
Finding 5. 70% of respondents rely mainly on Microsoft, OpenAI, Anthropic, AWS or Google to secure their AI agents
Those five providers’ built-in controls are the primary agent security layer for 70% of respondents, and 21% name a specialist security or identity vendor such as CrowdStrike or Okta.
Enterprises can secure agents with controls built into the model and cloud platforms the agents run on, or with specialist tools for security and identity management.
We asked which agent security vendors, platforms or approaches the organization uses today, and which is its primary agent security layer.
Finding 5 — Agent security vendor, platform or approach
Bases: 101 respondents who named at least one tool, including one who named only a tool outside the list; one who chose only "No dedicated agent security tooling" is left out. Primary layer: the same 101, including 3% who named a tool outside the list and one who named SentinelOne (Prompt Security), which is not shown. Several answers allowed for use, so that column sums past 100%; one answer for primary. Tools used by under 5% are not shown. Specialist tools are every listed tool except the five model and cloud providers' controls, custom in-house controls, open-source guardrails and runtime sandboxing.
Microsoft Azure is named as the primary layer by 22%, and OpenAI and Anthropic by 18% each, gaps that are statistically insignificant.
Respondents rated their primary agent security layer 3.92 out of 5 for overall satisfaction, 3.75 for ease of implementation and 3.65 for value for money.
Base: 101 respondents who named a primary layer.
Finding 6. Respondents are split on whether AI favors defenders or attackers
Asked who has the advantage as frontier AI models get better at finding and exploiting software flaws, 21% say their AI-enabled defenses are ahead and 17% say attackers using AI are ahead. Another 31% call it roughly even, and 25% say it is too early to tell.
Finding 6 — Who has the advantage in the organization's security today
Base: 102 qualified respondents. One answer each.
We asked which best describes the organization's agent security program today.
Finding 6 — Agent security program
Base: 102 qualified respondents. One answer each.
We also asked what share of the organization's security budget goes to AI and agent security today, and whether respondents think their AI-enabled defenses or attackers using AI currently have the advantage.
Finding 6 — Share of security budget on AI and agent security
Base: 102 qualified respondents. One answer each.
What changed since the September Pulse
We asked the questions below in the same words in September and October. We examined the results among in-house respondents and adjusted for differences in organization size. Consultants were 48% of September's qualified respondents and 20% of October's, and October's respondents work at larger organizations. Each Finding below holds among in-house respondents alone, and adjusting September's answers to October's mix of company sizes moves September's figures by up to about five points. After that adjustment, September's figures for the three Findings are 35%, 25% and 17%, and all three differences from October remain statistically significant.
The seniority mix also changed: directors, vice presidents and C-suite executives were 45% of October's qualified respondents, against 29% in September, a statistically significant difference. Adjusting September's answers to October's seniority mix moves September's figures for each Finding by up to about two points. After that adjustment, the three September figures are 36%, 22% and 15%, and all three differences from October remain statistically significant. The respondent profile gives both months' seniority mix.
Of October's qualified respondents, 95% came through a research panel. September's data does not record where respondents came from. The data cannot establish how much of any difference between the two surveys reflects who answered rather than changes in what enterprises do.
Findings: statistically significant changes
Findings: statistically significant changes
A Finding meets the 95% significance threshold overall and among in-house respondents alone. Bases, September then October: 102 and 101 for credentials; 102 and 102 for budget.
Directional changes
Directional changes
Directional means the difference meets at least the 90% significance threshold overall but does not meet the 95% threshold in both the full sample and the in-house subgroup. Bases: 102 and 102, except 102 and 101 for credentials. Among in-house respondents alone, planning new agent security within 12 months moves the other way, from 60% to 65%, so the overall decline does not hold for that group.
Statistically insignificant
Statistically insignificant
Statistically insignificant means the difference does not meet the threshold described in the methodology. Bases: 102 and 102, except 102 and 101 for credentials.
September's report found a gap in revocation by credential handling, 30% against 9%, on everyone who answered. Among September's in-house respondents alone, that gap was statistically insignificant.
What we did not compare
We did not compare revocation speed. September's report found that 14% of enterprises could have a named owner revoke an agent's access within minutes, on everyone who answered. In October the question was shown only to enterprises with agents in production or in a pilot, so the two figures cover different groups. The agent-identity count question changed the same way.
We did not compare the agent security tools enterprises use. In September, 82% of respondents who named a tool named exactly one, and the average was 1.2; in October the average was four. We cannot tell whether that difference reflects the respondents or how the answers were recorded, so we report October's tool use only. We did not compare the primary security layer, which only 16 respondents saw in September, or the ratings, which in October rate the primary layer rather than agent security tools in general.
The incident question gained a "Don't know" answer in October. September's data does not include three questions: how an organization would find out about an agent's unauthorized action, what happened in the most significant incident, and what happens after monitoring flags unusual activity. The questions on agents in production and on adopting a new solution in the past 12 months were not asked in September.
The bottom line: 46% of respondents say an AI agent caused a security incident or near-miss at their organization in the past 12 months
Of surveyed enterprises, 46% say an AI agent caused a confirmed security incident or a near-miss in the past 12 months, most of them near-misses. Of those enterprises, 79% plan to adopt a new, additional or replacement agent security solution within 12 months.
Among enterprises with AI agents in production or in a pilot, 60% of those that give each agent its own identity say a named owner could revoke an agent’s access within minutes. Of those whose agents share credentials, 33% say so.
In the next Pulse, VentureBeat Intelligence will measure whether the gap in revocation by credential handling holds, and whether the share of enterprises reporting agent-caused incidents or near-misses changes.
Respondent profile
| Respondent type | Respondents |
|---|---|
| Works on AI for the organization that employs them | 80% (82) |
| Consultant who works on AI for client organizations | 20% (20) |
Base: 102 qualified respondents. One answer each.
| AI agent deployment status | Respondents |
|---|---|
| Yes, in production | 68% (69) |
| Yes, piloting or limited rollout | 23% (23) |
| Not yet, actively evaluating | 7% (7) |
| No plans in the next 12 months | 1% (1) |
| Don't know | 2% (2) |
Base: 102 qualified respondents. One answer each.
| Organization size (main client, for consultants) | Respondents |
|---|---|
| 100–250 employees | 17% (17) |
| 251–500 employees | 23% (23) |
| 501–1,000 employees | 9% (9) |
| 1,001–5,000 employees | 14% (14) |
| 5,001–10,000 employees | 7% (7) |
| More than 10,000 employees | 31% (32) |
Base: 102 qualified respondents. One answer each.
| Job level | September | October |
|---|---|---|
| Individual contributor | 23% (23) | 34% (35) |
| Director | 10% (10) | 21% (21) |
| Manager | 31% (32) | 19% (19) |
| C-suite | 11% (11) | 18% (18) |
| VP | 9% (9) | 7% (7) |
| Partner or principal | 11% (11) | 2% (2) |
| Other | 6% (6) | 0% (0) |
Bases: 102 September and 102 October qualified respondents. One answer each.
Methodology
Who answered. VentureBeat Intelligence fielded this VB Pulse survey in October 2026. The survey received 113 responses, of which 102 qualified. Respondents qualified if they work on AI at an organization with 100 or more employees, or consult for one as their main client with day-to-day or partial access to its AI systems.
Who did not qualify. We excluded staff at technology vendors serving their own customers, consultants without access to their main client's systems, and in-house respondents with no direct role in their organization's AI work. One respondent who did not give an organization size was also excluded.
Consultants. Consultants answered about the client organization where they spent the most time on AI work. Consultants are 20% of qualified respondents.
Where respondents came from. Of qualified respondents, 95% came through a research panel and 5% through a VentureBeat email.
Who each figure covers. Each percentage is based on the respondents a question applies to, named in the note under each table. The revocation and agent-identity count questions were shown only to enterprises with agents in production or in a pilot, as the questionnaire specifies.
Agents in production. The credentials question asks about agents in production but was shown to everyone. Nine respondents whose organizations do not have agents in production or in a pilot answered it. Leaving them out, 59% say each agent has its own identity and 39% say some or most agents share credentials. Limited to enterprises with agents in production, leaving out pilots, the share saying revocation would take more than a day or require tracing the credential first is 23% against 2%, still statistically significant.
Several answers. The questions on agent security tools in use and on how an organization would find out about an agent's unauthorized action allowed several answers. Their figures count people, not selections.
Small groups. Some groups in this report have fewer than 40 respondents. Enterprises whose agents share credentials, among those asked about revocation, number 36, and enterprises describing their program as Observe number 26. Margins of error here are conventional calculations that assume a random sample, which this is not. On that basis, a result for a group of 36 could differ by about 16 percentage points either way, and for a group of 26 by about 19.
Tests. We describe a difference as statistically significant only when its test gives p below 0.05. Two percentages from separate groups use the two-proportion z-test, or Fisher's exact test when either group has fewer than 40 respondents. Two answers from the same respondents use an exact binomial test.
Changes from September. Each change is labelled a Finding, Directional or statistically insignificant. A Finding must meet the 95% significance threshold overall and among in-house respondents alone. The in-house check repeats the test without consultants, whose share fell from 48% to 20%; it does not test other changes in who answered.
Survey changes. October showed the questions on agents in production and on the primary security layer to everyone they applied to. October also added the question on adopting a solution in the past 12 months, added "Don't know" to the incident question, and split the 251–1,000 size band. The rating question now rates the primary security layer.
Respondents chose to take this survey, and they come from a research panel and VentureBeat's readers. Because the sample is self-selected, the results describe these respondents and may not hold for all enterprises.
Published by VentureBeat Intelligence. © 2026 VentureBeat. All rights reserved.