Summary
AI agents are moving rapidly into enterprise applications and endpoints, but governance systems are struggling to keep up. CIO surveys and security-industry data point to a widening gap between knowing that an agent exists and knowing what it can do, what it has done, and whether it should remain active.
Deployment is accelerating faster than governance
Enterprise adoption of AI agents is moving from experimentation into production, but the systems used to govern that adoption have not advanced at the same pace. Gartner forecasts that task-specific AI agents will be integrated into 40% of enterprise applications by the end of the year, up from less than 5% previously. The forecast points to a sharp change in how software operates inside companies: applications are increasingly expected not only to present information, but also to interpret context, call tools, and complete sequences of tasks.
That shift is creating a visibility problem for information-technology leaders. A survey conducted by The Harris Poll for Dataiku covered 685 CIOs in the United States, the United Kingdom, France, Germany, the United Arab Emirates, Japan, South Korea and Singapore. It found that 81% of respondents could not fully see AI agents created by employees outside formal, approved channels.
The issue is therefore broader than whether an organization has approved a particular model or application. Leaders need to know which agents are operating, who created them, what systems they can access, what credentials they use, and whether their actions remain within the original business purpose.
The inventory question has changed
Traditional endpoint management is built around a relatively static question: what software is installed on a device? That question has historically been useful because most software waited for a person or a scheduled process to tell it what to do. An AI agent changes that assumption.
Agents can read local files, invoke tools, call APIs and carry out multistep actions in the periods between human reviews. As a result, an installation record alone cannot explain the risk associated with an agent. The more useful questions are what the agent is allowed to do, what it has actually done, and whether those actions can be reversed or audited.
According to excerpts from Automox’s endpoint research, 46% of organizations currently automate endpoint inventory and monitoring. That figure highlights the gap between the growth of active software agents and the maturity of the systems intended to observe them. Endpoint management is no longer only a software inventory problem. It increasingly involves identities, permissions, tool calls, data access and behavior over time.
Vendor telemetry cited in the reporting also indicates rapid growth. Cyberhaven Labs said enterprise adoption of endpoint-based AI-native applications rose 509% over the past year, while BeyondTrust’s Phantom Labs reported a 466.7% year-over-year increase in AI agents inside enterprise environments. These are vendor measurements rather than industry-wide statistics, so they should not be treated as a definitive market count. Their significance is directional: multiple sources are observing a substantial increase in agent activity while governance infrastructure remains uneven.
Monitoring does not equal management
The Dataiku findings illustrate the difference between visibility and control. Ninety percent of CIOs said they had complete tracking of all their agents. Yet 72% said they could not consistently confirm whether those agents were delivering the business outcomes for which they were built.
A system may therefore be able to report that an agent is running without being able to determine whether its output is accurate, compliant, useful or still necessary. This distinction is especially important because agents can continue operating after the original business context has changed. A temporary experiment can become a production dependency, or an agent created for one workflow can retain access after that workflow has been redesigned.
Lifecycle management is another weak point. Eighty-three percent of respondents said their organizations lacked standardized lifecycle management for agents, and 67% estimated that 51 or more agents were running in production. Forty-seven percent said they had already decommissioned more than 20 agents this year. Decommissioning activity may indicate that organizations are pruning outdated systems, but it also shows that the population of agents is changing quickly enough to require ongoing governance rather than a one-time approval process.
Cost visibility is limited as well. Only 21% of CIOs reported complete, near-real-time visibility into AI costs by team or use case. For agents, those costs can involve more than model calls. They may also arise from tool use, external APIs, data processing and repeated execution. Without that detail, it becomes harder to assess whether an agent is producing an appropriate business benefit and harder to identify unusual activity.
Why permission scope raises the stakes
The security concern is not simply that an AI agent might make a bad decision. It is that the decision can be executed and replicated at scale. Automox CEO Justin Talerico contrasted an error on one machine with the same error pushed across an entire fleet. The first may be a localized mistake; the second can become a crisis before teams have finished understanding what happened.
That distinction makes permission design central to agent governance. An agent with access to local files, internal services or enterprise APIs may be able to turn an incorrect interpretation into a chain of system actions. The more agents an organization operates, the more distributed their permissions become, and the harder it is to reconstruct the full path of an incident through after-the-fact review alone.
Security organizations have consequently warned that agents can become a new form of insider threat. The phrase does not necessarily imply malicious intent. An employee-created agent may be acting on the employee’s instructions while still creating insider-like risk through excessive permissions, poor configuration, compromised credentials or an unexpected interaction with another system.
The governance challenge is compounded by unclear ownership. When CIOs were asked who should own an agent that goes wrong, the responses were divided among shared teams at 23%, central IT at 21%, data or AI teams at 20%, and security, risk and compliance at 18%. The distribution reflects the cross-functional nature of agent deployment, but it can also leave organizations without a single accountable decision-maker when an agent needs to be paused or terminated.
Building an accountable control framework
The survey results do not suggest that enterprises have no monitoring capabilities. They suggest that monitoring, permissions, business outcomes and accountability have not yet been connected into a complete control loop. Recording an agent in an inventory does not prove that its access has been reviewed. Successful execution does not prove that it achieved the intended outcome. Decommissioning an agent does not necessarily mean that its credentials, data connections and downstream permissions have also been withdrawn.
A more complete framework would begin with a continuously updated agent register. It should identify the creator, responsible team, purpose, operating environment, model dependencies, connected tools and data sources. Organizations would then need to limit permissions to the minimum required for the stated task and periodically reassess whether those permissions remain justified.
Operational logs should capture tool calls, API activity, data access and material outputs, not merely whether the agent was online. Human escalation rules are also important. Teams need to define which actions require approval, what behavior triggers suspension, and who can authorize a restart or permanent shutdown. These controls should connect with existing identity management, endpoint security, data-protection and compliance processes rather than operate as a separate AI-only layer.
This does not necessarily mean that companies must halt every AI deployment. It does mean that the speed of deployment cannot be the only measure of progress. As agents become embedded in workflows involving sensitive information and critical systems, the key organizational question will be whether the company can demonstrate that each agent operates within a defined permission boundary, leaves an auditable trail, and can be held accountable when its behavior diverges from its purpose.
The next phase of enterprise AI may therefore be judged less by how quickly organizations can create agents and more by how reliably they can govern, review and retire them. In that environment, visibility is only the starting point. The durable requirement is control that is explainable, reversible and assigned to a clearly responsible owner.
Source: link