Enterprise AI agent fleets doubled in 4 months; governance lags
Gravitee's *State of AI Agent Security 2026* report, published in April 2026, documents a sharp acceleration in enterprise AI agent deployment paired with a widening governance deficit Agentry.
The survey of 750 executives and technical leaders conducted between December 2025 and April 2026 shows the median enterprise AI agent fleet roughly doubled in size over that four-month window. Organizations that reported running 26–50 agents in December 2025 had scaled to 76–100 agents by April 2026 Agentry.
Monitoring Coverage Falls Behind Deployment
Mean monitoring coverage across agent operations increased modestly, from 46.96% to approximately 52% over the same period Agentry. The gap between the rate agents are deployed and the rate they are monitored has become a material risk vector. In practice, this means roughly half of the agents operating inside a typical enterprise remain invisible to security and compliance teams.
Governance Structures Absent at Scale
Pre-deployment security governance is even more severely constrained. Only 19.7% of respondents reported being able to fully secure and govern agents before they enter production. More starkly, 85% of enterprises had no formal accountability structure for agent behavior, leaving no clear assignment of responsibility when an agent fails, leaks data, or breaches a policy Agentry.
The result is a governance crisis unfolding in real time. As agent counts accelerate—driven by competitive pressure and efficiency gains—the infrastructure for controlling, auditing, and corralling agent actions has not kept pace. Organizations are effectively running blind at scale.
Business Pressure Driving the Gap
The four-month doubling cycle reflects a common pattern in fast-moving technology adoption: early wins and cost savings drive rapid expansion, while risk management and compliance tooling lag behind by quarters or years. Enterprises are deploying agents faster than they can build accountability mechanisms, creating an asymmetry that regulators, auditors, and security teams are beginning to flag.
The Gravitee survey captures a inflection point. Agent deployment has moved from experimentation into mainstream operational use. Governance, by contrast, remains largely manual, fragmented, and reactive. For enterprises operating in regulated industries—financial services, healthcare, law enforcement—this gap poses existential risk. For others, it is a ticking liability clock.